From Rhetoric to Infrastructure—Codifying the System Already Running

During the recent State of the Union address, President Trump repeatedly invoked the “SAVE America Act” — framing it as a necessary safeguard for election integrity through expanded citizenship verification.

The messaging was clear: verification must become routine, centralized, and federally integrated. Less than twenty-four hours later, Iowa lawmakers advanced legislation that mirrors that national push — embedding recurring federal SAVE verification system checks directly into state election administration.

This is not coincidence. It is architectural alignment.

In the only statewide test of this model, nearly nine in ten Iowans flagged as “potential non‑citizens” turned out to be U.S. citizens. Iowa is not simply debating voter policy. It is wiring federal verification infrastructure into state law.

In December, we documented how the DHS’s existing Systematic Alien Verification for Entitlements (SAVE) came to Iowa through executive action.

Through a combination of administrative procedures the system architecture is already running in Iowa.

On February 25th, Iowa lawmakers advanced SF 2203 in the Senate (34–13) and HF 2501 in the House, bills that would formalize those connections and make recurring SAVE checks a requirement rather than an option.

The bills are not companions nor have they been reconciled. They are on parallel tracks. In Iowa, a bill passed by one chamber must pass the other chamber in the same form (or be reconciled) before it can go to the governor.

That limbo makes the current moment critical for public input: the core system is already wired, and the legislation would make it permanent.

Though texts differ, both bills would move Iowa from executive order and court settlement use to statutory mandate.

Under SF 2203, county auditors would verify registrations against SAVE, mark voters as “unconfirmed” if the database fails to confirm citizenship, mail notices, and—if the voter fails to return proof within 90 days—cancel the registration.

HF 2501 establishes similar verification mechanisms and narrows same‑day registration options.

On its face, this is framed as a procedural safeguard. But structurally, it embeds a recurring federal query mechanism into Iowa’s voter maintenance system. Verification shifts from an event-based safeguard to an ongoing data relationship between Iowa election officials and federal databases.

The implication is subtle but significant: The state becomes dependent on federal status codes to maintain its voter rolls. In plain terms: instead of checking citizenship once, the state would check repeatedly. And when databases don’t match, the voter—not the state—must fix the error.

State Sen. Sarah Trone Garriott warned during floor debate that the legislation piles “more brokenness on our already broken immigration system” and risks punishing eligible voters: “We are not only punishing the people we’re trying to weed out — if they exist — we’re punishing people who are eligible to vote”.

Together these proposals would legislate an identity‑matching architecture rather than a one‑time purge. If SF 2203 builds the verification pipeline, HF 2501 adjusts how flagged records are processed.

This is not a single reform. It is a layered system. To understand the architecture, follow the data flow.

The Data Pipeline: From the DMV to SAVE to County Election Officials

Under expanded SAVE integration, state DMV identity data for all residents may be aggregated into the DHS’s SAVE system to cross-reference citizenship indicators through federal systems. Under SF 2203 county auditors would start a 90‑day removal clock as soon as SAVE fails to confirm a voter.

That coupling of automatic flags and short correction windows effectively shifts the burden of proof from the state onto each voter. In a system that relies on federal match codes the state does not control, friction is inevitable; the SAVE algorithm does not eliminate human error—it encodes it.

The debate often centers on fraud prevention. But the structural change is the creation of a recurring federal-state verification loop. And Iowa already knows what that loop produces. In the only statewide test of this architecture, the results were definitive — and damning.

SAVE System Errors and Voter Verification Flaws

The danger is not theoretical: it is visible in Iowa’s own pilot. In 2024, state officials compared voter lists against legacy DMV immigration codes and flagged 2,176 registrants as potential non‑citizens. Court filings later revealed that only 277 were actually non‑citizens; at least 88 percent of those flagged were U.S. citizens, many of them naturalized Americans whose lawful permanent‑resident records were never updated in older DMV databases.

Getting flagged does not equal removal. However, the volume of flags determines administrative burden — and the burden shifts to the voter to resolve discrepancies within the cure period.

When verification systems expand in scope and speed, error tolerance matters.

And documented federal database inaccuracies — including naturalization lag and missing citizenship indicators — remain part of the equation.

The ACLU of Iowa called the program an “unjustified, intimidating effort” to police naturalized citizens, and voting‑rights attorney Jonathan Topaz warned that it invites discrimination against people who sound or look “foreign”. National voting‑rights advocates have echoed those warnings: ACLU policy counsel Molly McGrath criticised federal SAVE legislation as “an expensive solution in search of a problem” that will “kick eligible voters off the rolls”. Those observations are borne out in the results: naturalized citizens received provisional ballots and had to prove their citizenship, while county auditors later learned that the list itself was “fatally flawed.”

South Carolina election officials, in a letter to the U.S. Attorney General, said the system would require “large‑scale manual override” to avoid wrongly removing naturalized citizens.

A federal judge presiding over current litigation of the SAVE overhaul wrote that she was “troubled by the recent changes to SAVE” and “doubts the lawfulness of the Government’s actions.”

These are engineering warnings, not ideological critiques: when a bulk‑matching system hinges on incomplete DMV or SSA records, false positives multiply.

When you scale a one to one lookup database to a nationwide bulk ingestion model, prior error rates matter.

DHS’s SAVE user guide explains that when the system returns a “no match” or “incomplete” response—situations that commonly occur for citizens whose records lack a citizenship indicator—the local agency cannot correct the underlying federal record.

Only USCIS or the Social Security Administration can update the data, and individuals must navigate federal bureaucracy to clear their names.

These are not hypothetical risks. They are the documented performance of the system Iowa's legislature now proposes to make permanent.

The Convergence: When Federal Rhetoric Becomes State Code

The SAVE America Act would expand federal verification authority nationwide; Iowa’s bills operationalize that framework at the state level. What is pitched as a federal safeguard becomes, in Iowa, an everyday administrative workflow. The rhetoric of “election integrity” becomes recurring code.

Iowa has always maintained voter rolls. What changes now is the frequency of federal verification and reliance on federal databases—essentially federalizing voter lists that have historically been state‑maintained and decentralized.

If passed, the state bills would also put timeline pressure on flagged voters to prove their citizenship. It normalizes bulk federal verification queries of citizens’ private data. This is not about a single flagged record.

It is about converting voter maintenance into a data synchronization exercise with federal systems. Once embedded in code, such systems rarely contract.

They scale.

The legislative proposals therefore raise practical questions that remain unanswered. Before these bills are signed, these critical issues are still unknown and as of yet undefined in the bill language:

1. What notice is guaranteed before cancellation?

2. What is the current accuracy rate of the verification system?

3. Will the verification system be audited, and by whom?

4. What documentation will satisfy county auditors?

5. How quickly can DHS or SSA correct underlying records?

6. How often will recurring checks run?

7. What audit thresholds will be applied?

8. What error safeguards will be published?

9. How will cure notifications be delivered and tracked?

10. Will the state publish transparency reports showing how many voters are flagged, how many are ultimately removed, and why?

Voters deserve clarity not just about intent — but about implementation. Because once verification becomes routine, it stops being exceptional. And routine systems define the landscape far more than speeches ever do.

Without guardrails, instituting recurring SAVE verification checks risks normalising federal system that disenfranchises eligible voters and treats citizenship as a database field rather than a constitutional status.

What is pitched federally becomes routine administratively in Iowa.

The SAVE America Act may be debated in Washington. But in Iowa, the wiring is already being installed.

The proposed state statute now reflects the existing state and national architecture:

• A federal database.

• A recurring query.

• A defined purge window.

• A state compliance clock.

The policy language sounds procedural. The design is infrastructural.

Voters should respond with proactive steps rather than panic. To stop the transfer of your personal DMV data to DHS federal systems, contact your state legislators and urge them to oppose these bills.

Periodically verify your registration— especially if you have recently naturalized or changed your name. Confirm that your federal records reflect your current status. If you receive a notice from your county auditor, respond promptly—these letters will arrive under the authority of a law that presumes non‑citizenship unless proven otherwise. The machinery is in motion; civic vigilance is the only defense.

If you are a naturalized citizen, or your name has changed, consider bringing a passport, birth certificate, or naturalization papers when you vote.

But individual vigilance cannot substitute for structural accountability.

Citizenship Is Not a Database Field

The bottom line is that election law debates often focus on ballots, but this debate is about databases. Iowa’s bills would transform voter eligibility into a question of cross‑agency identity matching. Infrastructure persists; error rates compound.

Before the Legislature codifies this new identity layer, it should confront the operational evidence: in the only statewide test, nearly nine in ten flagged voters were U.S. citizens. When automation scales, past error rates aren’t footnotes — they are forecasts.

The machine is built, but it is not yet fully legalized. The window to unplug it is closing.

Share

Subscribe now

References

Iowa General Assembly. (2026). Senate File 2203: A bill for an act relating to the verification of United States citizenship of voters [Bill text and legislative history]. Iowa Legislature.

Iowa General Assembly. (2026). House File 2501: A bill for an act relating to the conduct of elections and including effective date provisions [Bill text and legislative history]. Iowa Legislature.

U.S. Citizenship and Immigration Services. (2023). Systematic Alien Verification for Entitlements (SAVE) user guide [PDF]. U.S. Department of Homeland Security.

U.S. Department of Homeland Security. (n.d.). Systematic Alien Verification for Entitlements (SAVE): Program overview [Web page]. U.S. Department of Homeland Security.

American Civil Liberties Union of Iowa. (2026, February 11). Iowa Secretary of State agrees to settle lawsuit after wrongly targeting naturalized citizens as “potential non‑citizens” [Press release].

Texas Secretary of State. (2019). Memoranda regarding SAVE pilot processing failure rates [Internal memoranda]. Office of the Texas Secretary of State.

South Carolina Election Commission. (2020). Letter to the U.S. Attorney General regarding SAVE verification burdens [Letter].

State of Florida, State of Indiana, State of Iowa, & State of Ohio v. Department of Homeland Security, Case No. 3:24-cv-00509-TKW-HTC (N.D. Fla. Nov. 28, 2025) (Settlement Agreement).

U.S. Citizenship and Immigration Services & Iowa Secretary of State. (2025). Memorandum of agreement between the Department of Homeland Security, U.S. Citizenship and Immigration Services and the Iowa Secretary of State regarding participation in the SAVE program.

Office of the Iowa Attorney General. (2025, December 1). Attorney General Brenna Bird secures election integrity win for Iowa [Press release].

Reynolds, K. (2025, October 8). Executive Order 15. State of Iowa Executive Department [Press release].

4 Republican states will help Homeland Security obtain driver’s records to check voters’ citizenship. (2024/2025). Associated Press / News Reporting.

Social Security Administration, Office of the Inspector General. (2006, December 18). Congressional response report: Accuracy of the Social Security Administration’s Numident file (Report No. A-08-06-26100).

U.S. Department of Homeland Security. (2025, October 31). Privacy Act of 1974; System of Records (DHS/USCIS-004 Systematic Alien Verification for Entitlements). Federal Register, 90(209), 48948–48953.

U.S. Department of Homeland Security. (2025, October 31). Privacy impact assessment for the Systematic Alien Verification for Entitlements (SAVE) program (DHS/USCIS/PIA-006(d)).

Fair Elections Center. (2025, December 12). Comment of Fair Elections Center to the Social Security Administration on the System of Records Notice for SSA Master Files (Docket Number: SSA-2025-0225).

U.S. Citizenship and Immigration Services. (2025, May 22). Optimizing SAVE: New options to create cases with a Social Security Number and by bulk upload.

U.S. Citizenship and Immigration Services. (2025, July 16). SAVE user reference guide, 10.1 bulk upload file management.

Plaintiffs' Amended Complaint (April 2025)—Selcuk v. Pate, Case No. 4:24-cv-00390, Amended Complaint for Declaratory and Injunctive Relief (S.D. Iowa Apr. 4, 2025).

State Defendant's Supplemental Declaration (November 2024) Selcuk v. Pate, Case No. 4:24-cv-00390, Supplemental Declaration of Michael Ross (S.D. Iowa Nov. 1, 2024).

Final Settlement Agreement (February 2026) Settlement Agreement, Selcuk v. Pate, Case No. 4:24-cv-00390, Exhibit A (S.D. Iowa Feb. 9, 2026).

Iowa Secretary of State. (2025, March 20). Iowa Secretary of State’s audit of voter registration lists finds 277 confirmed noncitizens registered to vote [Press release].

Primary documents & prior SAVE evidence lockers (paid archive): Restoring Democracy’s Promise — Subscriber Vault.

On its face, the SAVE America Act (H.R. 1238) appears to be a straightforward effort to prevent noncitizens from voting: run names through a federal database and remove anyone who isn’t a U.S. citizen.

But beyond politics, this is a systems-architecture decision. Once you follow the data flows, you realize the capabilities extend far beyond elections. The SAVE America Act does not create a new verification system. It codifies one already active.

Using legislative backfill, the SAVE Act provides regulatory cover while formalizing and nationalizing a verification system already partially operational through executive agreements and federal–state data exchanges.

The bill doesn’t just check IDs. It mandates that states route entire voter rolls through federal immigration databases, extends photo‑ID mandates that push millions more voters into DMV systems, and deepens data pipelines between election officials, motor‑vehicle agencies and the Department of Homeland Security (DHS).

In other words, it tries to turn DHS’s Systematic Alien Verification for Entitlements (SAVE) database into a national citizenship-eligibility verification tool that elections are then forced to rely on.

Supporters frame it as fraud prevention; critics see something larger: the construction of a unified identity framework.

Once state election databases, DMV records and federal immigration data are stitched together, those pipes can be used for more than checking citizenship. The legislation encourages the creation of cross‑system identifiers—sometimes join keys, linkage keys or unique linking IDs—that allow disparate systems to match a person across agencies and states.

When Verification Meets Reality

Three states have tried to use SAVE or similar systems to purge rolls. Their experiences reveal technical and civil‑rights problems that the federal bill doesn’t solve.

Texas: When the System Broke

During a pilot program, Texas ran 1,657 voter‑file records through the updated SAVE system. Because SAVE was built to verify benefits eligibility for specific individuals, it was never designed for bulk election screenings. Roughly 300 queries failed outright, an 18 % processing failure rate blamed on duplicate entries, formatting differences and other data problems. In other words, nearly one in five records couldn’t be resolved.

In engineering terms, that isn’t statistical noise. It’s structural instability. The SAVE verification system wasn’t designed for this caseload.

Iowa: When Citizens Were Flagged as Suspects

In 2024 the Iowa secretary of state used old DMV records to mark 2,176 registered voters as potential noncitizens. The list was kept secret, and the targeted voters received no notice. Civil‑rights groups sued and discovered that only 277 of the 2,176 were not U.S. citizens. At least 88% of those flagged were U.S. citizens, many of them naturalized citizens whose earlier lawful permanent resident records had never been updated in legacy DMV files. The American Civil Liberties Union (ACLU) of Iowa argued that the program was a “discriminatory and unreliable” attempt to undermine voters of minority race and naturalized citizens.

The system is most confident where it is most wrong. Naturalized citizens.

South Carolina: The Data Demands Expand

South Carolina’s experiment, outlined in 2023 planning documents, highlighted the same structural weaknesses.

Officials warned that SAVE data would miss naturalisation updates, mis‑match names and require manual follow‑up in a large number of cases. In effect, the state would have to build a parallel review process to account for stale or ambiguous matches.

These are not passive verification fields. They are structural linking mechanisms — persistent identifiers that allow records to match and migrate across agencies.

Figure 1 summarizes the real world results.

The technical failures are only part of the story.

How Identity Keys Become Infrastructure

To match voter rolls to immigration data, states need more than names and birth dates. They need persistent identifiers that can link records across systems. The SAVE America Act encourages states to work with DHS and DMVs to create or access “golden records” and cross‑agency linking identifiers.

As we outlined in Part  4 of our series, DHS and states have already signed memoranda of understanding (MOUs) that let election officials query SAVE and DMV data in bulk. The technical paperwork describes linkage keys built from Social Security numbers, driver‑license numbers or other unique codes. Such keys make it easy to join disparate databases, but once they exist they can be used far beyond voter registration. The Department of Homeland Security has already proposed linking these records to facial images at DMVs and state agencies.

These cross‑system keys or persistent identifiers are quietly building a national identity layer. Voting systems do not need to see your face to confirm your citizenship. Yet the architecture increasingly allows them to. Those links can be reused for other purposes—from tracking immigration enforcement to matching protest footage to driver‑license photos. Once facial images and DMV records are linked to voter files, we leave election administration and enter the world of persistent person-tracking.

Our earlier report showed that this architecture already exists thanks to MOUs signed between DHS, the Social Security Administration and several states. The SAVE America Act would codify that infrastructure rather than building it from scratch.

Experts Warn the Infrastructure Is Unstable

Civil‑rights attorneys warn that the bill’s underlying technology threatens more than voting rights. After the Iowa purge, Rita Bettis Austen, legal director of the ACLU of Iowa, said that the program was an “unjustified, intimidating effort” that risked disenfranchising eligible voters.

National ACLU attorney Jonathan Topaz said the Iowa list targeted citizens and “created a real risk that those voters would be wrongfully denied their right to vote”. Election officials involved in pilot programs also noted that using SAVE at scale would produce many false matches and require manual adjudication, undermining the supposed efficiency of automated checks.

Even immigration analysts have raised alarms. They note that linkage fields designed for benefits management can be repurposed for surveillance. Once a person has a universal linking ID shared across agencies, it becomes trivial to aggregate travel records, DMV photos, health data and voting history. Such a system is ripe for abuse unless strict limits are imposed on data use and retention.

From a systems perspective, they’re describing the same failure mode Texas and South Carolina flagged in technical memos: a tool built for case‑by‑case checks behaves unpredictably when repurposed for bulk screenings inside election timelines.

From Election Law to Identity Records

For two decades, debates about voting have centered on ballots, access, and fraud prevention.

The SAVE America Act reframes the debate.

It does not simply adjust voting rules. It embeds voter eligibility into a broader identity verification architecture — one that links election systems to DMV databases, federal immigration records, and persistent identity keys that can outlive any single election cycle.

The question is no longer just:

Who is eligible to vote?

It becomes:

What permanent identity record is being built in the process of answering that question?

When voter verification requires interoperable identifiers, cross-agency matching, and photo-linked credentials, the scope expands beyond election law. It becomes a matter of how the state constructs, links, and retains identity records.

Infrastructure matters because infrastructure persists.
Election laws change.
Data systems endure.

That is the shift this bill represents.

References

American Civil Liberties Union of Iowa. (2026). Settlement agreement reached in ACLU, LULAC lawsuit over “potential noncitizens” voter list.

Texas Secretary of State filings (2025). SAVE system pilot testing documentation.

South Carolina election planning documents (2023). SAVE integration memoranda.

U.S. Department of Homeland Security. (n.d.). Systematic Alien Verification for Entitlements (SAVE) program.

U.S. House of Representatives. (2026). H.R. 1238 — SAVE America Act.

On June 12, 2025, a senior federal immigration official quietly demonstrated a voter-verification system to a private political network.

The public was not invited. Voting-rights organizations were turned away. Congress would not be informed for weeks.

The system already existed. The law authorizing it did not.

The people who had spent years challenging the legitimacy of American elections were the first to learn how the federal government planned to verify them.

What follows is not a theory. It is a documented sequence — drawn from court filings, whistleblower disclosures, internal agreements, and federal admissions — showing how a private political agenda crossed into public infrastructure, and how a system once designed to verify benefits was transformed into a national gatekeeper for citizenship itself.

Two SAVEs, One Cover Story

Why the SAVE Act debate hides the SAVE system already in use

Much of the public debate now unfolding in Congress treats the SAVE Act as the origin point of federal voter verification. It is not.

While Republicans push the stalled bill in Congress—a priority the House GOP that passed earlier this year and now sits contested in the Senate—a system with the same name is already running.

Since the spring of 2025, federal agencies have been expanding the Systematic Alien Verification for Entitlements (SAVE) program from a case-by-case immigration tool into a bulk screening pipeline—one capable of ingesting entire voter rolls, matching them against Social Security records, and flagging U.S.-born citizens for review for the first time.

That name collision matters. It creates a kind of institutional fog: search for “SAVE” and the public encounters a legislative fight in Congress, not a working database quietly processing state records. Whatever the intent, the effect is the same—the debate over the bill can obscure the system already in use.

Are you allowed to exist in the system today and without having to prove yourself again, in the databases that govern eligibility and participation?

This installment is the story of how that machine was accelerated into place: who got briefed early, who rewired the stack, and why the “verification” rationale doesn’t match the appetite of the agreements—bulk ingestion, unique identifiers, and the kind of identity data no election system needs to “check citizenship.”

Over the last year, that system has been retooled to do something unprecedented: ingest state records at scale and output a citizenship verdict for voting list data trimming. The name collision isn’t a coincidence—it’s camouflage. It turns every search into noise, while the machine keeps running.

The public didn’t learn any of this from a press conference. But one network got a walkthrough.

The Private Briefing

On June 12, 2025, U.S. Citizenship and Immigration Services (USCIS) officials held a briefing with the Election Integrity Network, a private voter-challenge organization run by activist Cleta Mitchell. The meeting, led by USCIS official David Jennings, is referenced in multiple federal court filings and was later the subject of a joint FOIA request seeking records of the briefing.

That session shows up in court filings and FOIA demands not because it was ceremonial, but because it functioned like a working handoff: here’s the machine; here’s how to use it; here’s what it will produce.

While DHS declined to provide comparable briefings to voting-rights organizations, the EIN session became a factual predicate in subsequent litigation challenging the expansion of the SAVE database.

The same network that spent years promoting mass voter challenges and disputing certified results is now positioned to influence—directly or indirectly—the federal systems used to “verify” citizenship at scale.

Jennings explained what the SAVE database could now do: bulk uploads, SSN matching, free access for states. The activists on the call had spent years trying to build exactly this capability outside the government. Now it was being handed to them from the inside.

No comparable briefing was offered to voting-rights organizations. No notice was sent to state election administrators, other than for Texas and Louisiana pilot programs. Congress would not be informed for another month.

The people who had spent years challenging the legitimacy of American elections were the first to learn how the federal government planned to verify them.

Mitchell was not a neutral election lawyer who happened to be interested in list maintenance. She was on the January 2, 2021 call where Trump pressed Georgia’s Secretary of State to “find” enough votes to overturn the result — a role that forced her resignation from her law firm.

In the years that followed, she helped build a national “election integrity” network that trained Trump supporters to challenge voters and worked to dismantle existing safeguards like the ERIC interstate data‑sharing compact.

By June 2025, the same ecosystem that had tried to overturn the 2020 election from the outside was being invited inside the federal government’s new citizenship‑verification machine and given a private briefing on how to use it at scale.

The Rewrite (When SAVE Quietly Changed Scope)

In early 2025, USCIS did not announce a new voter-screening system. It updated a fact sheet.

That sounds small—until you compare what the agency said before the upgrade to what it said after.

For most of its existence, SAVE was not designed to verify the citizenship of U.S.-born citizens. It was a case-by-case immigration verification tool—built to confirm eligibility for benefits using identifiers that already existed inside DHS systems.

Then, in the spring of 2025, that constraint vanished. And you can see the shift in USCIS’s own language.

Between March and May, DHS quietly re-engineered SAVE from a pull-based verification service into a push-based ingestion system. Instead of asking questions one person at a time, states were enabled to upload entire voter rolls at once—millions of records in a single batch—allowing the federal system to run automated citizenship checks across whole populations.

This was not a policy change. It was an architectural one.

From Lookup Tool to Intake Pipeline

Under the original SAVE model, verification required identifiers that already existed inside DHS systems—such as an Alien Registration Number or a naturalization certificate number. That design ensured SAVE only touched people who had already interacted with the immigration system.

The overhaul removed the boundary.

Under the new configuration, SAVE accepts Social Security numbers (including partial SSNs), names, and dates of birth. That shift brought a new population into scope for the first time: U.S.-born citizens who have never had an immigration file at all.

Once voter rolls are uploaded, SAVE does not simply answer yes or no. It performs matching across federal datasets and returns flags and status indicators that states are expected to act on—often within strict time windows.

For immigrants, the system includes a safety valve: the "Institute Additional Verification" process that triggers human review when automated checks fail. For U.S. citizens queried through the SSN pathway, that valve was removed. If the automated check fails, the case closes with no escalation. A clerical error at SSA becomes an automatic non-confirmation — with no human ever seeing it.

This is how a verification tool becomes a screening engine.

The system didn’t need Congress to exist. It needed an access channel—and someone willing to implement it.

The paper trail is now public—if you know where to look. And once states refused the handoff, the federal government tried to take the data through the courts.

The Compliance Pretext

Publicly, the Department of Justice frames these demands as routine compliance: a standard request to enforce voter list maintenance and ensure states follow federal recordkeeping rules. In that story, the lawsuits are housekeeping—transparency, integrity, compliance.

But the record describes something else: a system rebuilt for scale, then defended as if scale has no constitutional consequences.

In United States v. Weber, Judge David O. Carter did not treat the federal demand for sensitive voter file fields as ordinary. In his dismissal order, he warned that democracy is not lost all at once, but “chipped away… piece-by-piece,” and described the case as one of those cuts that “imperils all Americans.” He also emphasized that privacy erosion and voting-rights restrictions belong in public legislative debate—not unilateral executive action.

He went further. The court criticized the DOJ for obscuring its real purpose, rejecting “pretextual” explanations that conflict with what the government has said outside the courtroom. The opinion describes a nationwide push to centralize sensitive voter data—an approach the court tied to chilling effects on registration and turnout.

In the hearing itself, California’s Deputy Attorney General Malcolm Brudigam put the stakes in plain language—warning that the action should “make the stomach of every American turn,” because the federal government was moving “state by state” and “vacuuming up” voter registration data at an unprecedented scale.

That split is the point of this chapter. What DOJ describes as compliance looks, in operation, like acquisition—built to scale, normalized through litigation, and defended as if privacy harms are collateral. Once the system exists and the data starts moving, everything downstream stops being hypothetical. It becomes workflow—who gets flagged, who gets reviewed, who gets removed, and who never learns why.

What they claim: law enforcement of voter list rules.

What the record shows: a nationwide acquisition project—normalized through litigation, and defended as if privacy harms are collateral.

That is the access channel.

The Access Channel

From Administrative Integration to Legislative Backfill

Once SAVE crossed the threshold from a case-by-case lookup tool to a system capable of intake at scale, the central question was no longer technical. It was administrative: who could access it, under what conditions, and with what assumptions of authority.

This is where the story shifts from architecture to governance.

SAVE’s expansion did not arrive through a single statute or public vote. It arrived through integration—via guidance, training materials, interagency coordination, and the quiet normalization of new workflows. Access did not require a declaration that the system had changed. It required only that agencies be told how to use it.

That process has a name in modern public administration: efficiency.

Across federal and state agencies, “efficiency” functions as a delivery language. It justifies consolidation, accelerates deployment, and reframes structural change as technical improvement. In this case, it provided the rationale for connecting systems, broadening identifiers, and onboarding new users without pausing for explicit legislative authorization.

This is where DOGE enters the picture—not as a policy originator, but as a mechanism. The newly created Department of Government Efficiency’s (DOGE) role is procedural: streamline, modernize, standardize. But when applied to a system that touches voting infrastructure and citizenship status, that procedural framing carries substantive consequences. It changes sequencing. Instead of authorize, build, then audit, the order becomes build, deploy, normalize and then backfill oversight.

Notably, this expansion did not follow new authorizing legislation. By the time Congress began debating the SAVE Act, the underlying verification infrastructure was already in use—and already being introduced to outside stakeholders. When systems go live before laws do, power migrates quietly—from legislatures to administrators.

It is against this backdrop that the SAVE Act enters the narrative. And while Congress argued over statutory cover, DOGE marketed the system as a finished product.

Here’s how the system was sold publicly — and why marketing doesn’t equal legal authority.

DOGE’s public messaging frames SAVE as settled infrastructure: free, scalable, and already delivering results. In that framing, readiness is treated as permission.

But public marketing does not resolve legal exposure. Once states transmit sensitive identifiers—driver’s license numbers, partial Social Security numbers, full voter-file join keys—the risk does not remain federal. It transfers.

Some states behaved as though that distinction mattered. Others treated availability as permission. That divergence is not ideological—it is procedural.

Kentucky shows what that divergence looks like when a state pauses at the access boundary.

Kentucky: Waiting for Legal Cover

Kentucky’s posture is revealing not because it is resistant, but because it stops at the access channel. Officials did not reject cooperation outright. They limited it—providing non-sensitive fields while withholding the identifiers that make bulk matching workable.

That distinction matters. It shows that some states do not treat the existence of the SAVE system as sufficient authorization to feed it.

In Kentucky, the naming collision becomes useful. SAVE the database is already live. SAVE the Act is still being debated. And until that ambiguity is resolved, state officials are forced to decide whether “system ready” equals “authority.”

That gap—between what exists and what is authorized—is the fog.

Kentucky’s hesitation highlights a deeper sequencing problem that appears throughout this investigation. Infrastructure was built. Access pathways were established. Training and coordination followed.

Only afterward did Congress begin debating whether—and how—to authorize what was already implemented.

This is the same sequencing pattern described earlier: implementation first, authorization later. When that order is reversed, discretion fills the gap—and discretion doesn’t live in law. It lives in people.

The Personnel Pipeline: The Human API

Administrative systems don’t run on statutes. They run on people—and the fastest way to change a system’s real-world behavior is to place the right people at the routing points where policy becomes workflow.

This is where the story narrows from infrastructure to staffing.

If the architecture shift made SAVE scalable, the personnel pipeline determines how that capacity is framed, operationalized, and justified inside government. The key transition is not “outsiders influencing government.” It is a movement learning to staff government.

This is why appointments matter even when they’re procedurally normal. A title is not a headline. A title is a permission structure: it defines who sits in which meetings, who sees which briefs, who signs which memos, who controls which implementation timelines.

One of Mitchell’s closest collaborators in that post‑2020 ecosystem, Pennsylvania activist Heather Honey—whose public claims about the 2020 election and ERIC were amplified across right-wing media and used to justify “Stop the Steal” narratives—would soon be listed on an internal DHS org chart as the department’s Deputy Assistant Secretary for Election Integrity.

Because this function sits where “data outputs” become “administrative action,” it’s less a messaging desk than a conversion layer—turning flags, lists, and guidance into enforceable routines. This isn’t a claim that any single appointee controls the system. It’s a description of how staffing decisions change what gets prioritized, measured, and implemented.

In DHS materials dated August 18, 2025, Honey is listed as Deputy Assistant Secretary of Election Integrity under Office of Strategy, Policy and Plans, placing “Election Integrity” inside the department’s formal administrative chain.

On paper, that chart is just a diagram. In practice, it shows something more consequential: “Election Integrity” is not merely a political slogan or an outside pressure campaign. It is a named administrative lane inside DHS.

This is the institutional hinge. Not character assassination. Governance mechanics.

The significance is not that any one person is uniquely powerful. It is that the pathway exists—and once a pathway exists, it attracts coordination, deference, and momentum. The meeting described in the previous section becomes legible only in this light: the system’s builders created scale; the access channel created availability; and the personnel pipeline created the conditions for normalized use.

Staffing is the accelerant — but it is not the system itself.

Once access is granted and pathways are normalized, the real work begins elsewhere: in the data layer, where records move faster than statutes and oversight arrives last. That infrastructure has a name, even if it rarely appears in public.

The Shadow Database

How the Data Actually Got There

At this point, the question is no longer whether SAVE expanded—but whether the data it relies on was ever lawfully obtained.

In Part IV of this series, we documented what the system does: bulk uploads, 45-day purge clocks, the confidential MOU that turns federal flags into state-level removals. But it left a question unanswered.

Where did the data come from?

The official story is straightforward: DHS signed a data-sharing agreement with the Social Security Administration. States upload voter rolls. SAVE queries SSA records. Citizenship status comes back.

That story is incomplete.

Whistleblower disclosures to the Senate Homeland Security and Governmental Affairs Committee reveal that the data powering SAVE’s new capabilities did not travel through normal interagency channels. Before any formal agreement existed, DOGE personnel — including Edward Coristine and others identified in Senate testimony — created a “live copy” of the Numident file — the master database containing the Social Security numbers, birthplaces, and parents’ names of every American — and placed it in an unmonitored cloud environment.

The SSA’s Chief Information Security Officer explicitly warned that “standard policy prohibits the use of production data in development environments” due to “reduced control measures and oversight.”

The Warning That Was Ignored

The SSA's career cybersecurity officials did more than warn. They quantified the danger.

On June 12, 2025 — the same day USCIS briefed the Election Integrity Network on SAVE's new capabilities — SSA's Office of the Chief Information Officer generated a formal Risk Acceptance Request Form for the cloud environment DOGE was demanding.

The form used the agency's standard five-point risk matrix:

Impact: 5 out of 5 — "Catastrophic."

The assessment noted that unauthorized access would result in "catastrophic damage to or loss of agency facilities and infrastructure" and widespread compromise of personally identifiable information.

Likelihood: 3 out of 5.

In SSA's framework, that score corresponds to a statistical probability between 35 and 65 percent.

The total risk score: 15

The agency's designation for "Very High."

The whistleblower complaint specifies what "catastrophic" meant in practice. The environment contained live production data — names, Social Security numbers, birthdates, parents' names — for between 300 and 450 million Americans. If breached, the complaint states, "the government may be responsible for re-issuing every American a new Social Security Number at great cost.”

Put simply: the system now determining citizenship status for voting was built on a copy of America’s most sensitive population database, moved without proper authorization, and knowingly placed in an environment rated “very high risk” by its own custodians.

Because the environment lacked an Authority to Operate and was self-administered by DOGE appointees, the agency had no audit trail. They would not know if the data was stolen.

Four days later, on June 16, SSA Acting Chief Information Security Officer Joe Cunningham emailed DOGE appointee Aram Moghaddassi directly:

"Most security exposures and breaches occur within development environments due to reduced control measures... our standard policy prohibits the use of production data.”

One month later, on July 15, Moghaddassi signed the authorization anyway:

"I have determined the business need is higher than the security risk... and I accept all risks associated with this implementation.” He signed his name to a coin-flip chance of catastrophic breach — and the system went live.

This is not negligence discovered after the fact. It is negligence documented in advance, calculated to two significant figures, and formally accepted in writing.

The same database that now determines whether you can vote sits in an environment whose own risk assessment gave it a coin-flip chance of catastrophic breach — and someone signed their name to accept those odds.

One whistleblower reported that Numident data subsequently appeared at DHS in an “unusual format” — a detail suggesting the transfer bypassed the secure protocols that normally govern interagency data sharing. A 19-year-old staffer who had previously been terminated for leaking data was granted administrator access to the environment without SSA supervision.

The voter verification system running today queries data that its own custodians gave even odds of catastrophic compromise. That is the foundation the Golden Record rests on.

Documentation note:

All Pillar Investigations are free to read. If you want release alerts and access to the supporting document archive, subscribe here.

Full fact sheets, court filings, FOIA responses, and source PDFs cited in this section are preserved in the RDP Evidence Vault for subscribers who want to review primary materials directly.

The Cache, Not the Query

The technical architecture confirms what the whistleblowers described.

Under the old SAVE model, verification worked like a library lookup: a clerk submitted a query, SSA’s mainframe returned an answer, the transaction ended. The system touched records one at a time. It did not retain them.

The overhauled system operates differently. The Person Centric Entity Resolution (PCER) microservice — the engine behind SAVE’s new bulk capabilities — does not query SSA in real time. It queries a cached copy.

DHS technical documents describe PCER as a system that “caches and consolidates” data from source systems, then resolves identity fragments into a single persistent profile: the “Golden Record.” That record is stored in the DHS cloud infrastructure (AWS GovCloud), where it can be matched against incoming voter rolls at scale.

The infrastructure runs on a $279 million contract awarded to IBM, known internally as FALCON — the procurement vehicle that funded the Person Centric Entity Resolution engine now powering bulk verification.

This is the architectural shift that made bulk processing possible. SAVE is no longer asking SSA a question. It is querying a copy of SSA’s answers — a copy that was initially populated, according to whistleblower accounts, through the irregular data dump DOGE personnel created to bypass legacy constraints.

Retroactive Authorization

The government attempted to legitimize this arrangement months after the data began flowing.

The timeline is documented:

• April 2025: DHS and DOGE announce the SAVE overhaul. Fees are eliminated. Bulk upload is enabled.

• May 15, 2025: A secret “Letter Agreement” is signed between DHS, USCIS, and SSA — retroactively authorizing the matching of voter rolls against Numident records.

• October 31, 2025: The legally required System of Records Notice is finally published — five months after the system went live.

For five months, SAVE operated in a legal gray zone: processing U.S. citizens, ingesting SSA data, and building golden records without the public notice the Privacy Act requires.

Extraordinary Risk

The Senate Committee report does not mince words. It calls for the “immediate shutdown” of the new cloud environment at SSA that contains the Numident data, citing an “extraordinary risk” of data exfiltration by private actors or foreign adversaries.

That risk is not hypothetical. The same database that determines whether you can vote now sits in an environment that was built to circumvent oversight, staffed by personnel who lacked appropriate clearances, and authorized only after the fact.

This is not a procedural footnote. It is the foundation the system rests on.

Part IV showed the downstream machinery: the MOUs, the purge clocks, the states under pressure to “clean” their rolls. This section shows what sits upstream: a shadow database, an irregular transfer, and a retroactive paper trail designed to legitimize what had already been built.

If the data's provenance is irregular, every output derived from it inherits that irregularity. A voter flagged by a system built on an unauthorized data transfer has grounds to challenge not just the flag — but the foundation.

The question is no longer whether the system exists. It is whether anyone authorized it to exist — and whether the data it runs on was ever secure.

From Output to Outcome

How Scale Turns Errors into Consequences

The consequences of scale are not abstract. They’re procedural. They show up as letters, deadlines, and “cure windows” that convert database outputs into life disruptions.

Under a case-by-case model, errors are annoying but containable. A clerk notices a discrepancy, makes a phone call, resolves it before anything happens. Under a bulk model, errors become structural — produced at volume, processed on a clock, and routed into administrative action before anyone reviews them.

A bulk matching system doesn’t “discover truth.” It produces categories: match, mismatch, further review. Those outputs feed downstream workflows with fixed timelines. And because election administration runs on calendars, the burden shifts onto the individual to prove the machine is wrong — frequently on short notice.

This is where the mismatch becomes the event.

Name changes. Data entry variations. Naturalization delays that haven’t propagated to SSA. Partial SSN collisions. All of it becomes consequential — not because the system is uniquely malicious, but because the workflow is unforgiving. At scale, even a modest error rate becomes a pipeline of false flags. And those false flags do not remain in the database. They become notices, challenges, removals, or bureaucratic limbo.

Part IV documented the 45-day “clean” mandate. This is what that mandate looks like in practice: a mismatch flag, generated by an algorithm querying cached data of uncertain provenance, triggering a countdown that ends in removal unless the voter can prove the machine wrong.

The system doesn’t need to be malicious to cause harm. It only needs to be fast, opaque, and indifferent to its own error rate.

The rollout did not unfold as a cautious pilot. Adoption-window data shows states integrating in bursts — clustered around DOJ pressure campaigns, not around readiness assessments. The system scaled before the safeguards did.

But even this understates what was built.

The public debate has focused on voters — adults, registrations, rolls. That focus assumes a boundary: that the system activates when you turn eighteen and register. That the surveillance begins at civic adulthood.

The architecture tells a different story. Errors at scale are one failure mode. But the system's appetite extends beyond names and numbers.

When “Verification” Asks for Your Face

Citizenship is a legal status. You can verify it with biographical records — name, date of birth, Social Security data, naturalization documentation. You do not need a face.

That’s why the most revealing signal in this buildout isn’t a policy memo. It’s the data they demand. When a “voter verification” pipeline requests driver’s license numbers — and the infrastructure to resolve them — it stops looking like eligibility checking. It starts looking like identity ingestion.

From Iowa’s Settlement to a National Template

Part III of our series showed how Iowa and three other states signed a settlement committing to give DHS “full use” of their driver’s license records through Nlets, the law‑enforcement backbone that already moves photos during traffic stops and warrants. That language was not a drafting accident. It was the prototype: once “full use” exists in one settlement, it can be copied, pressured, and litigated into others.​

Part IV traced how DOJ’s confidential MOU overlaid that template onto the rest of the map — demanding unredacted voter files that include driver’s license numbers, and suing states that refused.

Your driver’s license number connects your voter registration to your full DMV file — photograph, signature, address history, and in many states, the biometric template used for facial‑recognition matching. The MOU’s insistence on driver’s license numbers is not about verifying that you exist. It is about acquiring the key that unlocks everything else.​

DHS’s revised SAVE notice completes the circuit. It explicitly authorizes using those identifiers to “validate information against NLETS” and to reach “other government enumerators” — bureaucratic shorthand for querying external systems, including DMV repositories, once the join‑key is in hand. At that point, the voter file is the intake. The DMV vault is the destination.​

What Changes When the System Can See Your Face

SAVE already supports photo‑based identity confirmation as a built‑in feature. The Person Centric Identity Services architecture behind it is designed to fuse biographic and biometric data into a single “Golden Record” that persists across checks. Once states provide driver’s license numbers — by settlement, MOU, or court order — the federal engine holds the key to attach a face to every name it ingests.

The “verification” frame collapses under that weight. Photos are not about citizenship. You cannot be more or less American based on your bone structure. Photographs are about building a biometric‑ready identity layer — one that can be queried, matched, and repurposed far beyond the narrow question of who is eligible to vote.

That is the quiet shift Parts III and IV were pointing toward. The same pipeline that now checks your name against SSA and SAVE can, with the same join‑key, see your DMV portrait, your signature image, your address trail — and fold them into a permanent identity model.

Once a system can ingest faces alongside names and Social Security numbers at nationwide scale, the question is no longer whether it works. It is who controls it, who gets to query it, and what the next administration does with it when the machinery is already humming and normalized.

The Golden Record: Surveillance Without a Birthday

For months, the public defense of this system has rested on a single, comforting premise: “It’s just about protecting the vote.”

That defense assumes the system only looks at adults. Because you have to be 18 to vote, we imagine the machinery of “election integrity” activates on your eighteenth birthday — not before.

That assumption is wrong.

The technical shift to SSN4 didn’t just make the system faster. It made it universal.

When DHS and DOGE rewired SAVE to query the Social Security Administration’s Numident file, they stopped checking a list of immigrants. They started querying the master registry of the American population.

The Numident is not a voter roll. It is not a list of drivers. It is a list of every human being who has ever been assigned a Social Security Number.

And you don’t get an SSN when you register to vote.

You get it when you are born.

By linking the verification engine to the Numident, the architects removed the floor from the surveillance architecture. The “Golden Record” — the persistent digital profile that follows you across federal systems — is no longer created when you enter civic life. It is created in the maternity ward.

DHS technical documentation confirms the design. The Person Centric Identity Services (PCIS) system builds profiles for “all persons” it encounters, regardless of age. Children applying for CHIP. Minors processed through naturalization. Seventeen-year-olds who pre-register to vote in states that allow it. All are ingested. All are resolved into the Identity Index.

The “continuous vetting” mandate is explicit: records created for children “can be related to their adult records later.”

This is not a voter-verification system with incidental data collection. It is a longitudinal surveillance architecture — one that begins writing your file before you can walk and never stops updating it.

The infrastructure doesn’t care about your age. It cares about status resolution.

The same system that flags a naturalized citizen for removal in Pennsylvania is capable of indexing a newborn in Iowa. The same “Golden Record” logic that decides whether you can vote at 30 was initialized when your parents filled out the paperwork in the hospital.

We are no longer discussing a system that verifies voters.

We are discussing a system that logs Americans — from birth.

Mismatches Become Life Events

This installment documented the architecture: who built it, how they wired it, where the data came from, and what it’s capable of reaching.

But architecture is abstraction. The system doesn’t flag “records.” It flags people.

The finale follows what happens when the pipeline meets a person: the naturalized citizen whose SSA file still says “legal alien” five years after the oath. The county clerk with 10,000 flags and a 45-day window. The seventeen-year-old whose citizenship was queried before she could vote.

At small volumes, mismatches are clerical errors — annoying, correctable, forgettable.

At scale, mismatches become governance. Under deadline pressure, mismatches become life events.

Once citizenship verification becomes a cached, biometric-capable intake system, rollback is no longer a policy choice. It’s an infrastructure problem.

This infrastructure will outlast the people who built it. The Golden Record doesn’t expire. The cache doesn’t reset. The join-keys linking your vote to your face don’t delete themselves when administrations change.

Whoever satisfies the next election will inherit a machine that can query the citizenship status of every American, cross-reference it with biometric data, and act on the results — without asking Congress, without notifying you, and without any structural limit on what it’s used for next.

The machine is running. Part VI shows who it finds.

Share

References

American Civil Liberties Union. (2025). Freedom of Information Act request regarding SAVE system modifications and interagency data sharing.

Bower v. Social Security Administration, Complaint, No. 1:25-cv-2713 (D.D.C. 2025).

Common Cause. (2025). Motion to intervene regarding DHS voter verification practices.

Department of Homeland Security. (2025). System of Records Notice: SAVE Verification System. Federal Register.

Department of Justice. (2025). Correspondence and filings regarding state voter-roll data requests.

League of Women Voters v. U.S. Department of Homeland Security, Complaint and Preliminary Injunction Memorandum, No. ___ (D.D.C. 2025).

Padilla, A., Peters, G., & Merkley, J. (2025). Letter to the Secretary of Homeland Security regarding SAVE system briefings and data access.

U.S. Citizenship and Immigration Services. (2025). SAVE voter registration and voter list maintenance fact sheet (archived versions).

U.S. Social Security Administration. (2025). Numident data governance and security policies.

Whistleblower disclosure to Senate Committee on Homeland Security and Governmental Affairs. (2025).

If you care about voting rights, privacy, or due process—share this with one local election official.

Share

TL;DR

Full reference list and primary documents are in the paid subscriber Evidence Vault.

• DOJ is asking states for full, unredacted statewide voter rolls—including driver’s license numbers and SSN4s—under a “confidential” MOU.

• The agreement imposes a 45 day compliance clock: if DOJ flags “anomalies,” states are pressured to “clean the rolls” fast.

• This isn’t just “election integrity.” It’s building a national verification pipeline—a system that can link identity + eligibility at scale.

• False flags are predictable when databases lag (naturalization updates, NUMIDENT timing, name mismatches): deadlines turn errors into purges.

• Iowa wasn’t an outlier—it reads like a pilot run for a scalable national permission layer.

• If you are naturalized, have changed your name, or have ever had a mismatch in SSA records, verify your voter registration status now—and document any “unable to verify” notices.

Table of Contents

1. The Offer: A “Confidential” Deal With a Deadline

2. The Network: The States in the Verification Grid

3. The Contract Engine: What the MOU Actually Demands

4. The Scale: From Lookup Tool to Infrastructure. Update (Feb. 20, 2026): An interactive exhibit mapping the contract and funding architecture has been added below.

5. The Skeleton Key: Bulk Upload + SSN4

6. The Data Trap: NUMIDENT Lag and Manufactured “Anomalies”

7. The Switchboard: The Machine Behind the Screen

8. Permanence Without Consent: The Records Don’t Roll Back

9. What This Builds: A Permission Layer for Civic Life

On a damp February morning, Lorenzo Gutierrez Lugo steered his black Dodge pickup south toward Brownsville, Texas. A Mexican-American trucker hauling clothing and furniture for a small transport company, he expected a routine drive—until a local cruiser pulled him over for 50 in a 45.

The real reason wasn’t on the roadside. Records show federal systems had already flagged his route as “suspicious.” Agents searched his truck, found only cash payments from customers, and arrested him anyway—accusing him of money laundering. They found no contraband. Charges were later dropped. His employer spent $20,000 on legal fees to clear his name.

That is what happens when sensitive personal data fuels a federal machine: a “flag” becomes a fact. And it’s the same kind of data the Justice Department is now seeking from state voter registration lists.

The same federal agencies that monitored Lugo’s license plate are demanding unredacted voter rolls from dozens of states. A confidential memorandum of understanding (MOU) spells out how states must hand over full voter lists—including driver’s-license and partial Social Security numbers—and “clean” the lists within 45 days. Although the Justice Department labeled the MOU confidential, a federal judge ordered the hearing transcript discussing it released to the public; the agreement is now part of public court exhibits accessible on PACER. This contrast between claimed secrecy and public availability underscores the high stakes at the outset.

DOJ’s stated rationale:

• DOJ argues it has a statutory role enforcing NVRA/HAVA list-maintenance compliance and needs access to statewide records to test accuracy.

• They say the MOU is meant to protect data during transfer/use and to standardize security procedures.

• DOJ frames the timeline as operational urgency—time-bound compliance and responsiveness to anomalies.

• DOJ frames the effort as election‑integrity enforcement and warns non‑compliant states they will be taken to court.

The counterargument from states/critics:

• States argue the request goes beyond what’s necessary and risks exposing sensitive identifiers (DL numbers, SSN4).

• Critics warn “anomalies” can reflect database latency or matching errors—deadlines can turn false positives into removals.

• “Confidential” terms reduce transparency and public oversight for a system that touches voting rights.

• Critics warn that the demanded identifiers aren’t “just voter rolls.” They are join-keys that can be linked across systems—sometimes all the way back to state ID records, including the photo on your driver’s license.

Both claims can be true at once: list maintenance is real—and a system designed for auditing can still function as a scalable eligibility gate if the data is centralized, time-pressured, and automated.

The States’ Offer

The clock starts the moment a state signs DOJ’s confidential SAVE MOU: 45 days and counting. That is how long election officials have to “resolve” every anomaly a federal database flags—names that don’t match, codes it doesn’t like, voters the system doesn’t recognize.

Miss the deadline and the state is out of compliance; meet it, and someone is struck from the rolls.

The first test of the MOU’s ultimatum came on Dec. 1, 2025. At 11:34 a.m., DOJ trial attorney Eric Neff sent Colorado officials a “confidential” contract with a 24‑hour deadline.

Neff did not ask for a meeting; he attached the draft MOU and demanded a reply by end of business the next day. The email offered a binary choice to avoid a federal lawsuit: surrender the state's unredacted voter roll and agree to "clean" the list within "forty-five (45) days" of any federal notice.

Neff promised the agreement would “cure all potential concerns,” then warned he doubted it would satisfy the state’s “various concerns” and asked for a quick decision: accept the MOU or prepare for litigation.

But the attachment doesn’t cure concerns. It codifies them.

Section XII.F goes further: it labels the entire agreement—and even preliminary communications—“confidential.” This wasn’t written for public debate.

The cost of that secrecy is surrender.

Under the MOU, states must hand over their entire statewide voter database, including driver’s‑license numbers and the last four digits of Social Security numbers (SSN4).

The federal government runs that file through its own verification engine called SAVE. If DOJ flags “issues… anomalies… or concerns,” Section VIII gives states just 45 days to remove “ineligible” voters.

Attorney General Pam Bondi framed list maintenance as essential to “free and fair elections,” warning that states that fail to provide accurate statewide voter lists “will see this Department of Justice in court.”

Critics don’t dispute the goal of accurate rolls. The fight is over the mechanism: bulk identifiers, a compressed deadline, and a system states can’t fully audit.

Forty-five days is an administrative cycle; for a voter correcting federal records, it’s a trap. The MOU turns the presumption of eligibility into a countdown to erasure.

This isn’t election "integrity"—it’s a federal permission layer built by contract, enforced by litigation, and executed by systems states can’t audit.

The Colorado MOU shows the mechanism in plain text: secrecy, mass data transfer, and a timed “clean” mandate enforced on DOJ’s terms.

This is not just about who gets a ballot. The same identity spine that can mark you as an “anomaly” in the voter file is wired, through Routine Use 50, into Treasury’s Do Not Pay system. The same system that can stop you at the polling place can also freeze a tax refund, block a Social Security payment, or hold up disaster relief. In this design, election integrity, eligibility for work, and access to money all hang from the same kill switch.

Colorado said no. Iowa said yes.

Colorado balked at DOJ’s terms. Iowa embraced Executive Order 15, reclassifying professional licenses as “public benefits” so they could be conditioned on federal clearance. That compliance didn’t just solve an immigration scandal—it proved the model. Once Iowa showed it could wire E‑Verify and SAVE into licensing and hiring decisions, DOJ packaged the same approach into the “confidential” MOU now sitting on desks in 26 other states.

Iowa as Proof of Concept

Iowa is not an outlier. It is the prototype.

As Part III showed, what happened here wasn’t a freak event—or a uniquely reckless governor—or a state that “went too far.” It was something quieter and more dangerous: administrative alignment. Iowa moved early into a system that was already designed, funded, and waiting.

That’s why this story does not stay in Iowa. The same tools, the same data fields, the same vendor stack, and the same federal interfaces now showing up here are already being adopted—quietly, unevenly, and often without public debate—in other states. Not because voters demanded it or because illegal voting is widespread, but because it fits—legally and operationally—into an expanding federal permission system for civic life. That architecture is built on SAVE.

For decades, SAVE — the Systematic Alien Verification for Entitlements — was sold as a narrow eligibility checker. A bounded system for a specific purpose: verifying immigration or citizenship status only when an agency had to make a benefits decision.

As detailed in Part III, Congress authorized this system in 1986 strictly to gate welfare access for non-citizens—never envisioning it would evolve into a permission layer for the American electorate. Transactional. Targeted. Politically containable. That’s the public story.

What exists now is different in kind, not just degree. Today, SAVE functions as something far more consequential: a digital eligibility backbone—an API-based permission layer that other systems can call to decide who gets cleared, who gets flagged, and who gets denied. When a “verifier” becomes infrastructure, it stops being a tool. It becomes a gate.

Verifiers don’t govern. Permission layers do

A verifier is supposed to answer a narrow question at a single moment: Does this record match what we need right now? If it’s wrong, the error is localized.

When did a benefits verifier become something that can gate a license, a job, or a ballot—and who authorized that expansion?

This is not semantics. It’s the danger. A database is passive; it waits for a question. A permissions layer is active; it sits between you and everything that matters.

Once SAVE is wired in as a dependency, the question is no longer “is this record correct?” but “did the system clear you?” Everything else becomes an implementation detail.

What a permission layer can decide:

• Renew or suspend driver’s licenses.

• Provide or deny benefits and services.

• Grant or deny professional licenses (nursing, teaching, medicine — treated as benefits rather than earned credentials).

• Determine eligibility for voter registration and continued enrollment.

• Trigger downstream “integrity” checks that can delay or block routine transactions.

The public rarely sees why these decisions are made. There is no visible rationale — just a drop‑down menu, a status code, a “could not verify.”

In a democracy, eligibility is a policy choice; in an administrative state, it becomes a software dependency. Once policy is recoded as a dependency, the machine stops asking permission. That quiet, technical shift is what changes everything.

Iowa Matters Because it’s Compatible — Not Because it’s Extreme.

This is where Iowa becomes instructive. Not because it is uniquely anything, but because it proved the model can be operationalized quickly when a state is willing to align its systems, fields, and timelines to federal demands.

Iowa didn’t invent the machine. Iowa showed the machine can run. Once it runs in one state, the next steps are simple: replicate, scale, and enforce.

That is what the “Confidential MOU” represents—and why the lawsuits matter. They are not isolated fights. They are the mechanism for building a national system out of fifty separate election administrations. Put differently: Iowa is not the exception that proves the rule; it is the proof of concept that becomes the rule once Washington decides to stamp it onto every state.

From Iowa to National Standard

This isn’t how a democracy is openly rewritten. It’s how an administration is quietly re-architected.

What looked like a discrete state‑level decision in Iowa was actually the first visible node in a coordinated federal campaign to convert the SAVE database from a passive immigration tool into a proactive national voter‑clearance engine. The evidence for that coordination is no longer theoretical; it is written in court transcripts, federal press releases, and the text of confidential contracts state officials never expected the public to see.

The Network: Twenty-six States and the “Confidential” Pact

The scope of this network is now a matter of record because DOJ was forced to name names in federal court. On December 4, 2025, during a hearing in United States v. Weber, DOJ Trial Attorney Eric Neff identified the states that had accepted the federal terms.

• The Confidential Pact: South Carolina, Nebraska, Montana, Mississippi, Missouri, Alabama, Texas, Virginia, Utah, Tennessee, and South Dakota.

• The Voluntary Compliers: Wyoming, Kansas, Indiana, and Arkansas.

• The Settlement States: Iowa, Florida, Indiana and Ohio.

Add legacy SAVE‑heavy states such as Arizona and Georgia, and the total matches USCIS’s November figure: twenty‑six states now integrated into a federal verification grid.

Subscribe for Free:

Join the Mission

This is what federalization looks like in practice: integration by paperwork, expansion by litigation. More than half the country has effectively nationalized its voter‑verification process, bypassing state legislatures to link local rolls directly to a federal enforcement engine.

The Mechanism: A “Confidential” Contract

The instrument of this realignment is not a law passed by Congress; it is a private contract. The “Confidential Memorandum of Understanding” offered to states like Colorado lays out the terms.

Section XII.F declares the MOU and all related communications “confidential,” shielding the transfer of power from public scrutiny. Section VIII imposes a “clean” mandate: once DOJ reports “anomalies,” the state “will clean its VRL/Data by removing ineligible voters” within forty‑five (45) days.

This clause federalizes voter-list maintenance. When algorithms in Washington flag a voter in Iowa or Texas, local officials are contractually bound to act. The state is no longer the arbiter of eligibility; it is the executioner on a federal clock.

The Ultimatum: Compliance or Litigation

The Colorado ultimatum shows the contract’s posture: comply fast or litigate. What matters next is what the contract does once the file is ingested.

The message to the states was binary: voluntarily feed the federal machine, or be ordered to do so by a judge.

That escalation matters because systems at this scale do not get built to answer a few clerks’ questions. They get built to run constantly, at population scale. To understand what that means, you have to stop thinking in terms of “checks” and start thinking in terms of throughput. What happens when a benefits‑era tool is rebuilt to process entire voter rolls on deadline?​

The answer shows up in the only place systems cannot hide: volume.

The Result: Industrial Scale Verification

For years, SAVE was a low‑volume system for specific benefit applications. In all of 2024, it processed about 25 million queries. By October 2025, after “optimization” for bulk voter checks, that number had exploded to 205 million.

Update (February 20, 2026): Part IV documents the scale of the verification system.

What it did not examine in detail is the funding architecture that makes that scale possible.

The interactive exhibit below maps the contract stack and funding pathways behind the architecture described here.

Figure 2 shows the scale; now we need the mechanism that makes that scale possible. A system doesn’t jump from “case-by-case verification” to large-scale throughput because states suddenly got curious—it jumps when the inputs and matching rules are redesigned for volume.

That’s what bulk upload and the SSN4 quietly accomplish: they collapse the distance between a targeted benefits check and a population-wide identity sweep. Once you can feed whole lists into SAVE and anchor matches on partial SSNs (instead of only immigration-specific identifiers), the universe of “checkable” people explodes—citizens included—because you’ve effectively handed the engine a universal key.

The moment you do that, the system’s weakest link becomes the thing that matters most: the upstream identity record it treats as authoritative. That’s where the trap snaps shut—because at scale, the machine isn’t verifying you; it’s verifying the version of you stored in SSA’s NUMIDENT, a static snapshot that was never built to govern eligibility across voting, licensing, and benefits in real time.

Iowa showed that a state could reclassify driver’s licenses as “public benefits” to bypass privacy laws. The federal government then took that logic, codified it in a confidential MOU, and rolled it out across half the union. The result is a national permission layer that treats the franchise as something to be renewed, not a right to be exercised.

That raises the next question: what kind of system can jump by millions of checks, and what did it have to become to do that?

From Alien File to National Registry

For decades, SAVE sat in the background of the bureaucracy, a narrow tool to verify the status of non‑citizens applying for specific public benefits like Medicaid or housing. It was a lookup service, not a grid.

In 2020, only immigrants and some naturalized citizens were eligible for SAVE benefits verification. To be checked, the system required an immigration ID.

In 2025, that changed. Through a series of technical overhauls and legal maneuvers, DHS turned SAVE from a “pull” system—one person at a time—into a “push” system capable of ingesting entire state populations.

From Immigration A-Number to SSN4

The critical technical shift came on November 3, 2025, when USCIS rolled out two new capabilities: Bulk Upload and SSN4 matching. Previously, SAVE required an immigration identifier such as an Alien Registration Number (A‑Number), which naturally limited queries to non‑citizens with immigration files.

The new architecture removes that limiter. States can now verify individuals using only a name, date of birth, and the SSN4. By switching the key identifier from an “A-Number” (which only immigrants have) to a SSN (which nearly every resident has), the federal government quietly converted an immigration database into a National Registry capable of scanning the electorate.

This is the system Iowa and twenty‑five other states have plugged into: one that uses stale data to generate erroneous flags, then uses confidential contracts to mandate purges based on those errors. Once a system like that exists, everyone who connects to it inherits the same logic: deny fast, correct slowly.

Ingestion, Not Inspection

The clearest proof that this system is built for permanent mechanical control, not human oversight, is in DOJ’s own filings. When states offered the traditional remedy—letting federal lawyers inspect rolls in person—DOJ refused.

In California, Secretary of State Shirley Weber invited officials to review a redacted voter database in her Sacramento office. DOJ rejected the offer and, in its motion to compel, demanded that the state “submit electronically” an unredacted file via the Justice Enterprise File Sharing (JEFS) system, including each voter’s driver’s license number and SSN4.

The distinction is critical. Those are not investigative leads; they are join‑keys—the unique identifiers needed to plug state records into the Person Centric Entity Resolution (PCER) engine. DOJ was not trying to see the list. It was trying to possess it.

The clock does not allow time for complex, human-led adjudication of citizenship, which is notoriously difficult to prove on a deadline. It forces the state to rely on the federal “flag.”

When Verification Becomes a Gate

Voter verification is the accelerant because it introduces two features benefits programs don’t always require: bulk processing and institutional urgency.

When those two features meet a federal permission layer, the result is predictable: more queries, more false positives, and less accountability.

The system doesn’t know who you are. It only knows whether you clear.

This repurposing changes the nature of the system because it transforms SAVE from a transactional lookup service into a mass ingestion pipeline. There is a fundamental difference between a tool that is occasionally consulted by a human clerk and a system that is queried in bulk by a state server.

The Skeleton Key: The SSN4 Shift

The most critical architectural change was not the volume of the queries, but the keys used to run them.

Under the 2020 rules, a state official literally couldn’t run SAVE on a typical U.S.‑born voter. The system required an immigration identifier—an A‑Number, I‑94, or similar—just to open the case. In May 2025, USCIS rewired the tool to accept searches by Social Security number specifically so agencies without immigration IDs could query the database anyway.

Then on November 3, 2025, USCIS loosened the Social Security enhancement further. The agency announced that states could now verify voters using only a name, date of birth, and the last four digits of a Social Security number (SSN4).

This technical shift had a profound structural consequence. While only non-citizens possess A-Numbers, nearly every American resident possesses a Social Security number. By switching the input key to the SSN, DHS technically unlocked the database to the general population.

The Static Snapshot Failure

The danger of this new architecture lies in the specific data it consumes. To perform these SSN-based checks, the overhauled SAVE system bypasses live immigration files and queries the Social Security Administration’s NUMIDENT file—a database the SSA itself has warned is not a definitive record of citizenship.

NUMIDENT is a "static snapshot." It records a person’s status at the time they applied for a Social Security card. It does not automatically update. If a lawful permanent resident becomes a naturalized citizen years later but does not update their Social Security record—a step not legally required for voting—SAVE will still flag them as a non-citizen.

The SSA’s Office of the Inspector General has estimated that 3.3 million U.S. citizens are misclassified as non-citizens in this database due to this "naturalization lag".

The Purge Clock

Under the "Confidential Memorandum of Understanding" sent to states like Colorado, this known data latency is weaponized.

Section VIII of the MOU does not merely provide data; it imposes a deadline. The agreement mandates that upon receiving notice of "anomalies" from the DOJ (generated by these static SSA records), the state "will clean its VRL/Data by removing ineligible voters" within "forty-five (45) days."

In the world of database administration, 45 days is a blink of an eye. In the legal world, it is a suffocating window. By the time a voter receives a notice in the mail, the clock has already burned down. The MOU ensures that the system’s default setting is deletion.

The Financial Kill Switch

This fulfills the surveillance logic we first saw in Part I: the shift from punishing crimes to policing “patterns.”

Buried in SSA’s revised System of Records Notice is “Routine Use 50,” which authorizes sharing NUMIDENT data with Treasury’s Do Not Pay system. If the voter‑verification algorithm flags you as “unverified,” that anomaly does not stay in an elections database. It can propagate to Treasury, where the same flag can trigger Do Not Pay screening and additional review—delaying payments until the record is resolved.​

This creates a structural trap. The federal system uses outdated data to generate a flag (the "anomaly"). The MOU then legally binds the state to act on that flag within a strict window. The burden of proof shifts instantly to the voter, who must now prove they are a citizen to a system that has already decided they are not.

The Leviathan — Not a Program, but a Dependency Stack

Public attention often fixates on "ImmigrationOS," the controversial analytics platform built by Palantir. But focusing on the dashboard misses the engine — a multi-billion-dollar "dependency stack" built to outlast any single administration.

The Engine: IBM and Your Digital Twin

While Palantir’s ImmigrationOS grabs headlines, the system that actually moves identity decisions is older, larger, and quieter. In May 2024, USCIS awarded IBM a $279 million “FALCON” task order to modernize the verification backbone—building and operating the Verification Information System (VIS), the transaction engine behind E-Verify and SAVE.

This isn't a file about you. In the eyes of the state, this file is you. If the flesh-and-blood voter says one thing, and the Golden Record says another, the machine is programmed to believe the record.

This is where “verification” stops being a lookup and becomes an identity model. Later in this report, I’ll show how that modernization enables a person-centric profile—your digital twin—to persist across systems long after the original query is over.

The Memory: HART and Peraton

If IBM provides the logic, Peraton provides the memory. Following its acquisition of Northrop Grumman’s IT division, Peraton manages the Homeland Advanced Recognition Technology (HART) system—the massive biometric database replacing the legacy IDENT system.

This matters because once a “verification” system has memory, it stops being a lookup tool. It becomes a national gate for anyone it can measure.

What does “Everywhere” Actually Mean?

When federal officials say this system will be deployed “nationwide,” they do not just mean it will be in every state. They mean it will be in every transaction.

The architecture of the Leviathan is designed to collapse the distance between a “voter check,” a “traffic stop,” and a “financial penalty.”

The Physical Enclosure

“Everywhere” also means the physical observation of movement is no longer local.

• If you drive: Your movement is captured by ALPRs and fed into state fusion centers like the Texas FCIC, where it is legally reclassified as "intellectual property" to hide it from public records requests.

• If you park: Your location is logged by private data aggregators like Verisk/ISO, which markets a "multi-billion-scan vehicle-location database" to insurance carriers to track where vehicles are garaged.

• If you cross state lines: Your data is shared via Nlets, the same interstate law enforcement backbone we exposed in Part II. The same pipe that funnels your license plate scans to a fusion center is now being configured to route your driver’s license photo to the DHS.

The system doesn’t need to arrest you to control you. It simply needs to deny your transaction. In this architecture, eligibility is not a right you hold; it is a status code the system assigns.

SAVE isn’t where the data lives. SAVE is where the decision happens. And decisions are governance. Even when they’re disguised as “verification.”

The Transformation Is Measurable — In Volume, Ambition, and Intent

The shift from a passive benefits check to a proactive mass‑surveillance grid is not speculation; it is quantified in federal records.

In 2020, SAVE’s role in elections was buried as one of many “lawful purposes.” By 2025, “voter registration and voter list maintenance” appears in the opening justification: it is now a primary design target of the overhaul, not a hypothetical side case.

Under Section VIII of that confidential deal, the state does not just share data; it surrenders authority. The process is not a dialogue; it is a loop:

1. Ingest: The state uploads the voter roll to the federal system.

2. Match: The DOJ runs the data against federal databases (SSA Numident/DHS SAVE).

3. Purge: Upon receiving notice of “anomalies,” the state “will clean its VRL/Data by removing ineligible voters” within “forty-five (45) days”.

As earlier mentioned, this is ingestion, not inspection. The demanded fields are join-keys.

The MOU mandates that upon receiving notice of “anomalies” from the DOJ, the state “will clean its VRL/Data by removing ineligible voters” within “forty-five (45) days”.

This effectively federalizes the administration of state elections. Local discretion collapses into a federal clock.

Because 205 million queries is not a “benefits tool.” That is national in scale.

That is the scale of something designed to be called constantly by other systems—until “verification” becomes so routine it stops looking like politics and starts looking like administration.

The Demand for Full Ingestion

The Department of Justice is no longer asking states to participate; it is suing them for total submission — demanding the electronic transfer of entire unredacted voter files.

When USCIS officials state, "We encourage all federal, state, and local agencies to use the SAVE program," they are describing a default. They are describing a future where "verification" becomes the connective tissue between every agency—so normalized that it no longer looks like surveillance, but simply looks like modern governance.

This is not red vs. blue; it is administrative alignment—the quiet construction of a national permission layer.

In practice, SAVE is no longer “a database.” It functions more like a federal verification gateway — an eligibility switchboard other systems call, quietly, at scale. That matters because the system scales larger through interfaces, contracts, and “optimization” work that rarely comes with a press conference.

And when the verification engine itself is being modernized — from distributed lookups to cached identity profiles and probabilistic match scoring — the question stops being what SAVE was designed to do.

This isn’t oversight—DOJ wants the electronic file because license numbers and SSN4s are the join‑keys the PCER engine needs.

The question becomes: what does this system become once it’s built to verify everyone, everywhere, all the time?

The Statutory Shell Game

The transformation of the American voter from a citizen into a “record” required more than just new software; it required a new legal theory. To build a national verification grid without passing a National ID law, the executive branch had to repurpose existing statutes that were designed to do the exact opposite of what they are being used for today.

Weaponizing the Civil Rights Act

To build this system, the DOJ had to weaponize a law designed to stop Jim Crow. In its lawsuits against California and Colorado, the government cites Title III of the Civil Rights Act of 1960—a statute passed to preserve records so federal prosecutors could prove registrars were suppressing Black voters.

Congress passed this law for a specific, historical purpose: to preserve election records in the Deep South so federal prosecutors could prove that registrars were systematically discriminating against Black voters. It was a tool for enfranchisement—a way to catch officials who were throwing away the registration forms of minority citizens.

Today, the DOJ is inverting that purpose — using the same statute to demand unredacted voter rolls that feed a computerized purge engine. They are using a civil rights law to build a surveillance list.

In its lawsuits against California and Colorado, the government explicitly cites Title III not to investigate discrimination, but to enforce “list maintenance”—a bureaucratic euphemism for purging voters. By invoking a civil rights statute to demand “unredacted” voter files, the DOJ is using a law meant to protect voters from the state as a tool to expose voters to the federal government.

“List Maintenance” As Data Capture

The government’s legal filings reveal that “compliance” is the pretext for data acquisition.

In United States v. Weber, the DOJ argues that it cannot verify whether California is properly “removing ineligible voters” unless the state turns over the “driver’s license number” and “last four digits of the social security number” for every registered voter.

This is the statutory shell game:

1. The Hook: The DOJ claims it is enforcing the National Voter Registration Act (NVRA) and Help America Vote Act (HAVA).

2. The Trap: HAVA requires states to maintain accurate lists but contains no provision forcing states to surrender those lists to the Feds.

3. The Switch: The DOJ uses the Civil Rights Act to demand the data, arguing that “list maintenance” is a federal right that requires federal oversight.

As the NAACP and League of Women Voters noted in their motion to intervene in the California case, this legal theory transforms the Attorney General from a guardian of voting rights into a “national voter registration administrator,” centralizing power in Washington that the Constitution explicitly delegated to the states.

The “Backdoor” ID Requirement

This legal maneuvering creates a functional National ID system without Congress ever voting for one.

The Fair Elections Center warns that by wiring the SAVE database (an immigration tool) into the voter registration process, the government has imposed a “backdoor documentary proof of citizenship” requirement.

Under this regime, a voter does not need to show a passport at the polls to be flagged; they simply need to have an “anomaly” in a federal file they cannot see. If a naturalized citizen’s Social Security record hasn’t updated to reflect their citizenship—a common “naturalization lag” acknowledged by the SSA—the SAVE system will flag them as a non-citizen. The state, bound by the DOJ’s “list maintenance” mandate, is then pressured to purge them.

The statute meant to stop registrars from purging eligible voters is now being used to feed a system that automates their removal.

To see how that became possible, you have to stop looking at the statute and start looking at the input tray.

The Technical Tell: Bulk Processing

Now that SSN-based queries removed the limiter; entire voter rolls are checkable.

This technical update fundamentally altered the system’s logic.

• Before: The system answered the question, "Is this specific applicant eligible?"

• Now: The system answers the question, "Who in this population is ineligible?"

The impact of this switch was immediate and explosive. When a system jumps into the hundreds of million transactions in a single year, it is no longer performing the same function. It has graduated from an administrative tool to a mass screening system.

The Scope Jump: SSA Integration Changes the Universe of Targets

If Bulk Upload provided the scale, the integration with the Social Security Administration (SSA) provided the targets.

Historically, SAVE required an Alien Registration Number (A-Number) to run a query. This acted as a structural safety valve: the system could generally only be used on individuals who had already interacted with the immigration system. U.S.-born citizens do not have A-Numbers; therefore, they were largely invisible to the database.

On November 3, 2025, USCIS removed that safety valve. The agency announced that states could now verify voters using only a name, date of birth, and the SSN4 alone.

That many people do not end up in the crosshairs by accident. To see how they got there, you have to stop looking at individual records and start looking at the machinery that is sorting them.

The Machine Behind the Screen (VIS, PCER, HART, ImmigrationOS)

To understand what the twenty-six states plugged into, you have to look past the acronyms. Public attention often fixates on "SAVE" or "ImmigrationOS" because they appear in headlines. But focusing on the dashboard misses the engine.

SAVE is merely the customer-service window. The actual machine is a multi-billion-dollar dependency stack built by private defense contractors to outlast any single administration.

From Verification to Identity Construction

In 2020, DHS’s own privacy documentation limited SAVE to immigrants, non‑immigrants, and certain naturalized citizens. U.S.‑born citizens sat outside the system’s official scope. By October 2025, that limiter was gone: the updated PIA explicitly authorizes SAVE to ingest and retain Social Security numbers for U.S.‑born citizens when agencies submit them for voter‑roll checks.

While Palantir’s $30 million contract for "ImmigrationOS" drew headlines, it functions largely as a user interface. The real scale of the system lies in the plumbing beneath it.

In May 2024, USCIS awarded IBM a $279 million task order known as FALCON to modernize the verification backbone. IBM is building and operating the Verification Information System (VIS), the central transaction engine that powers both E-Verify and SAVE.

Crucially, this modernization creates a new architectural component called the Person Centric Entity Resolution (PCER) microservice.

In the older model, verification was a momentary pull: the system checked a record, returned a result, and moved on.

Under PCER, the logic shifts toward cache and resolve—consolidating identifiers from multiple sources into a persistent identity profile. Inside the system, that profile is called a Golden Record. In plain language, it is your digital twin.

That shift matters because the system no longer just verifies who you are at a moment in time. It constructs an authoritative version of you—and, by design, that version can persist beyond the original purpose of the query. Once that digital twin exists, the system doesn’t ask whether the record is right. It asks whether it clears.

This is the point where “verification” stops being a check and becomes a model.

The Memory: HART and Relationship Mapping

If VIS provides the logic, HART provides the memory.

Managed by Peraton (following its acquisition of Northrop Grumman’s IT division), the Homeland Advanced Recognition Technology (HART) system is the massive biometric database replacing the legacy IDENT system.

HART is not just a digital fingerprint repository. It is a cloud-native platform hosted on AWS GovCloud designed to fuse "multimodal" biometrics: face, iris, and fingerprint data.

The DHS technical specifications confirm that HART is designed to store and map "Relationship Patterns". By linking biographic data, encounter locations, and third-party data, the system builds a social graph of individuals—moving the question from “Who is this?” toward “How is this person connected?”

That shift is the tell. Once a system can model relationships, it stops being a records tool and becomes an operational instrument. And operational instruments don’t live in spreadsheets—they live behind dashboards, where complex pipelines get turned into simple choices: flag / route / detain / remove.

The Dashboard: ImmigrationOS

Sitting on top of this stack is ImmigrationOS, the platform built by Palantir Technologies under a $30 million contract awarded in April 2025.

ImmigrationOS is not the database; it is the lens. It creates a digital twin of the immigration lifecycle, fusing data from the IRS, SSA, and local police to track individuals through the deportation pipeline. It is designed to provide "near real-time visibility" into targets, utilizing the data lakes filled by the systems below it.

Seen from above, the full structure looks like this:

Once you see the stack, the marketing language about “simple verification” reads differently. This is not a lookup; it is a rules engine with a memory, built to be called again and again by other systems that depend on its decisions.​

The last question is who controls that engine—because once verification becomes national, whoever owns the stack effectively owns the rules of citizenship.​

The Privatization of Sovereignty

The most dangerous feature of this stack is not its power, but its ownership. The core logic of American identity verification is now wrapped in the intellectual property rights of private vendors.

• Peraton holds the biometric keys.

• IBM manages the verification logic.

• NEC Corporation provides the "black box" facial recognition algorithms.

• Amazon (AWS) hosts the data.

You cannot FOIA an algorithm owned by Peraton. You cannot vote out the board of IBM. The "Intellectual Property" laws—like those passed in Texas—protect their trade secrets, which happen to be your movements and biometrics.

The government has outsourced the machinery of the Fourth Amendment to companies that view your identity as a renewable contract.

Permanence Without Consent

The architecture of this system was not debated in Congress. It was not authorized by a specific ballot initiative. It was assembled through a series of administrative agreements and vendor contracts designed to survive political turnover.

Here’s the tell: the pipes were connected before the public was even told the pipes existed.

The durability of the Leviathan relies on three specific mechanisms: retroactive legalization, contractual lock-in, and the inversion of the burden of proof.

Retroactive Legalization: The SORN Maneuver

The most telling detail in the construction of this network is the timeline of its authorization. The federal government built the data pipelines first and asked for legal permission second.

• The Act: On May 15, 2025, DHS, USCIS, and the Social Security Administration (SSA) signed a "Letter Agreement" to begin bulk-matching voter rolls against the SSA Numident file.

• The Cover: The agencies did not publish the legally required System of Records Notice (SORN) describing this new surveillance capability until October 31, 2025—five months after the data sharing began.

By the time the public was invited to comment on the system, millions of records had already been processed. The "comment period" was a formality for a system that was already operational. This is known as "policy laundering": implementing a capability in secret, then codified it as a "routine use" once it is too entrenched to remove.

Contractual Lock-In: The Long Horizon

Even if a future administration wanted to dismantle this system, they would face a firewall of private contracts and binding settlements.

The settlement agreement announced by Iowa Attorney General Brenna Bird does not just authorize data sharing; it mandates it for 20 years. By entering into this agreement, Iowa, Florida, Ohio, and Indiana have legally bound future governors and legislatures to a federal data-sharing regimen that extends well into the 2040s.

For the other states signing the "Confidential MOU," the lock-in is technical rather than contractual. Under the Department of Homeland Security’s retention protocols, once a state feeds its voter rolls into the SAVE system, that data is retained for 10 years—meaning the federal government maintains the digital dossier long after any single election cycle has passed.

Whether by a 20-year contract or a 10-year retention policy, the result is the same: the data checks in, but it doesn't check out.

Furthermore, the physical infrastructure of the system is owned by private vendors. The $17.1 million contract between the Texas Department of Public Safety and Flock Safety includes a provision that data uploaded to the state LPR database must be retained for a minimum of three years. Because this data is legally designated as the "intellectual property" of the state intelligence center under recently enacted Texas SB 1499, it is insulated from standard public records requests and legislative oversight. The state cannot simply "delete" the data, because contractually, the data has become a permanent asset.

The Inversion of the Burden

The final mechanism of permanence is the shift in legal burden. In the traditional justice system, the state must prove you are ineligible. In the Leviathan, the algorithm presumes you are ineligible until you prove otherwise.

The "Confidential MOU" codifies this inversion. Under Section VIII, once the federal PCER engine flags a "data anomaly," the clock starts. The state must "clean its VRL/Data" within 45 days.

There is no pause button for the voter to hire a lawyer. There is no requirement for a judge to sign a removal order. The machine generates a flag, and the contract mandates an execution. If the citizen cannot navigate the bureaucracy of three different federal agencies (SSA, DHS, USCIS) to correct the Golden Record within that window, their rights are administratively deleted.

The system is designed to be fast, mechanical, and permanent. The appeals process is designed to be slow, manual, and rare.

That is not a glitch; it is a theory of governance. Once eligibility is delegated to a timed, opaque flag, the country is effectively ruled by whatever the red light on the dashboard says.

Republic of the Red Flag

We were raised to think the most dangerous government power comes from laws passed in public, debated by legislatures, and signed by governors.

In reality, the most dangerous power comes from systems built as “administration,” expanded as “modernization,” and then normalized as “best practice”— until the public wakes up one day and discovers the country is running on a permission layer they never consented to.

The 45 day "clean" mandates are not requests for accuracy; they are algorithmic purge orders.

A system that defines eligibility before it corrects errors is not neutral. It is decisive. And it is already running.

This is governance by database: a regime where eligibility is decided first, and error correction — if it happens at all — comes too late to matter.​

The system does not know who you are.

And when the system decides you don't clear, there is no one left to call.

Documentation note: Key terms and quotes come from filed federal exhibits and public records (PACER). A full reference list and primary-document vault are available to paid subscribers.

References & Primary Documents

• Department of Homeland Security. (2025, October 31). Privacy Act of 1974; System of Records (DHS/USCIS-004 Systematic Alien Verification for Entitlements). Federal Register, 90(209), 48948–48953.

• Department of Homeland Security. (2025, October 31). Privacy impact assessment for the Systematic Alien Verification for Entitlements (SAVE) program (DHS/USCIS/PIA-006(d)).

• Department of Justice. (2025). Confidential memorandum of understanding regarding participation in the SAVE program for voter registration and voter list maintenance purposes. (Exhibit 2 in United States v. Griswold).

• Neff, E. (2025, December 1). Voter registration list request follow up [Email to Andrew Kline, Colorado Deputy Secretary of State]. U.S. Department of Justice, Civil Rights Division.

• Reynolds, K. (2025, October 8). Executive order number 15. State of Iowa Executive Department.

• Social Security Administration. (2025, February 20). Privacy Act of 1974; System of Records (Master Files of Social Security Number (SSN) Holders and SSN Applications). Federal Register, 90(34), 10025–10029.

• Social Security Administration, Office of the Inspector General. (2006). Congressional response report: Accuracy of the Social Security Administration’s Numident file (A-08-06-26100).

• U.S. Citizenship and Immigration Services. (2025, November 3). USCIS enhances voter verification systems [Press release].

• United States v. Griswold. (2025). Complaint (Case No. 1:25-cv-03967). U.S. District Court for the District of Colorado.

• United States v. Weber. (2025). Transcript of proceedings (Motion Hearing, Dec. 4, 2025) (Case No. 2:25-cv-09149-DOC-ADS). U.S. District Court for the Central District of California.

Share

Table of Contents

1. The Database They Won’t Name — what SAVE is and how it drifted

2. How Iowa Wired the Pipe — EO 15 mandates an identity clearinghouse

3. The Nlets Backdoor — How the state of Iowa DMV vault feeds the federal engine

4. What It Does to People and Cities — Mark, Des Moines, the human and municipal impact

5. What Iowa Really Built — What Comes Next. Systems, Oversight, and “Sunlight”

Part III of the Warrantless Surveillance Series By Restoring Democracy's Promise. Part II is here. Read Part IV here.

TL;DR – What Iowa Just Did

• Iowa secretly reclassified your driver’s license and every state professional license as a “public benefit,” so it could run you through a federal immigrant-benefits database built in 1986.

• In exchange for “voter checks,” the state agreed to give DHS full access to Iowa’s DMV vault—photos, signatures, addresses, biometric metadata—through the Nlets law-enforcement network for 20 years.

• That creates a closed identity loop: your data flows upstream to DHS; opaque federal status codes flow back down to decide whether you can drive, work, or vote.

• Newly naturalized citizens can already be auto-flagged and delayed because SAVE lags reality. The same mechanism could be repurposed to quietly sideline protesters, journalists, or whole neighborhoods.

• This isn’t just about immigrants. Every licensed Iowan is inside a federal surveillance prototype—built by executive order and a lawsuit “settlement” no one voted on.

The System That Couldn’t be Named

On December 1st, Iowa Attorney General Brenna Bird announced a “major victory” for election integrity. She told reporters the state had secured access to a powerful “federal system” to verify voters. But she refused—repeatedly—to say its name.

She called the system “the database”, “federal verification tool”, “advanced federal screening technology,” and other vague terms. None of the publicly released statements from Bird or state officials mention SAVE by name, despite the settlement granting access to it. Not once. Not in the press release. Not in the Q&A. Nor was the system name mentioned in the triumphant victory lap she took afterward on conservative media.

And to most Iowans, that omission wouldn’t register — because “SAVE” sounds like nothing. A vague acronym. A bureaucratic footnote. Something that belongs on a dusty shelf in Washington. The kind of acronym reporters casually drop into paragraph four without ever realizing they’ve buried the entire story.

But to anyone who actually understands immigration systems — anyone who has lived inside them, fought against them, or worked through the bureaucratic machinery that governs them — that silence is deafening.

Because SAVE is not a “federal verification database.”

It is not a voter-identification tool.

It is not a law-enforcement system.

SAVE — the Systematic Alien Verification for Entitlements — is a federal benefits-eligibility database created in 1986 solely to help determine whether immigrants qualified for Medicaid, food stamps, or housing aid.

For decades, that narrow, public benefit-focused purpose is what made SAVE obscure and mostly uncontroversial. It sat in the background of the benefits bureaucracy, doing work almost no one outside that world ever thought about.

Until recently.

In the last several years, its mission has drifted. Under pressure from politicians and agencies looking for shortcuts, SAVE has been pulled away from its original role and repurposed for new targets and new kinds of checks it was never built—or democratically authorized—to handle.

Iowa just took that drift and turned it into a hard swerve. SAVE is the system the state has now plugged into the heart of its election machinery and licensing regime. Bird carefully and conspicuously avoided naming the very database her press conference was about.

Why? Because the moment you say “SAVE,” anyone who understands the law begins asking the questions she cannot answer:

1. “Why is Iowa using a benefits system to screen voters?”

2. “Who authorized this shift in purpose?”

3. “What data did the state have to trade to get access?”

4. “And why did the Attorney General avoid the word entirely?”

This article answers those questions.

In The ALPR Trap (Nov. 2025) I documented how Iowa quietly wired local plate data into the national Nlets network. This new settlement shows that same pipe has recently been extended into the DMV vault and the SAVE database.

What Bird celebrated on December 1st wasn’t a “victory” at all. It was the public ribbon-cutting for a data pipeline Iowa quietly built two months earlier, under the cover of a completely different scandal — a pipeline never meant for one superintendent with fake credentials, but for every licensed Iowan and every professional license whose data flows through the state.

To see how that machine was assembled, you have to go back to October 8th — to an executive order that was sold as a school-safety fix, but was actually something else entirely.

How a School Scandal Became a Statewide Monitoring Machine

Two months before Brenna Bird walked to the podium and announced her “major victory” for election integrity, Governor Kim Reynolds signed Executive Order 15.

On the surface, EO 15 looked like a fast, decisive response to a single, outrageous failure: the hiring of former Des Moines Public Schools superintendent Ian Roberts, later arrested by ICE and revealed to have fraudulent documents and an outstanding order of removal. The image was made for TV: federal agents at a school district office, the governor denouncing “bureaucratic breakdowns,” and promises of tougher screening to make sure it never happened again.

Reynolds framed the order as the fix. The problem, she said, was that Iowa didn’t have strong enough verification for school leaders and other licensed professionals. The solution, she claimed, was to require E-Verify and tighten background checks. Local and national outlets ran with that frame. The headlines were almost interchangeable: Governor mandates E-Verify after superintendent scandal. The public takeaway was simple—this was about cleaning up one hiring system that had failed spectacularly.

But that story only survives if nobody reads the actual order. Don’t take my word for it — here are the documents.

Once you move past the talking points, EO 15 stops looking like a targeted repair and starts reading like a blueprint. The bulk of its operative sections have almost nothing to do with school districts or superintendent searches. They are about something else entirely: building a new data pipeline that ties Iowa’s driver’s license system to a federal immigration benefits database.

In the text of the order, Reynolds directs the Iowa Department of Transportation to “take all steps necessary” to give the newly consolidated Iowa Department of Health and Human Services direct, electronic access to the SAVE program. That’s not a side note—it’s a core instruction. In the same breath, the state of Iowa DOT is told to open up its full driver’s license and ID database to HHS, not for a narrow, high-risk list of positions, but as an ongoing information feed.

State HHS is then instructed to expand its use of SAVE. The order pushes the agency to run federal eligibility checks on people receiving public benefits, including programs that had never required immigration-status verification before. In other words, a single employment scandal in one school district becomes the justification for a sweeping, statewide reconfiguration of how identity and eligibility are checked across multiple systems.

Put in plain language, EO 15 quietly does three things:

1. It puts the state HHS in the middle as a new “clearinghouse” for SAVE queries in Iowa.

2. It gives that clearinghouse a direct tap into the driver’s license and state ID database.

3. It normalizes using a federal immigration benefits determination system as a gatekeeper for licenses and services that were never designed to run through SAVE at all — and, as we later learned, voter verification as well.

None of that has anything to do with a superintendent in Des Moines.

Seen as code instead of spin, EO 15 is not a clean-up operation; it’s a construction project. The Roberts scandal is the scaffolding. The real build is a statewide identity-verification machine that can be pointed wherever the executive branch wants it pointed—teachers this month, benefits recipients next month, voters after that. Once you realize what that pipeline connects, the stakes shift.

Once you understand the three endpoints—DOT at the front, HHS in the middle, DHS/SAVE at the back—the structure of the machine snaps into view. Iowa didn’t repair a system after a scandal. It built a new one. The state quietly rewired the entire identity backbone so that everyday bureaucratic actions—license renewals, address updates, benefits applications—have started flowing through a federal verification system designed for immigrants, not citizens.

On paper, the order sounds like it’s aimed at one superintendent and a few “high-risk” positions. In practice, the language sweeps in almost everything the state touches. Medical licenses. Nursing licenses. Law licenses. Teaching certificates. Engineering, real-estate, insurance, cosmetology, commercial driving — if a board in Iowa can grant or renew it, EO 15 gives the executive branch a path to run it through the SAVE clearinghouse.

This is the part that was never said out loud. This is the part you weren’t supposed to notice.

To see the architecture as the state wired it, not as it was described publicly, it helps to trace the flow the way engineers would.

Figure 1 maps the actual pipeline created by EO 15.

EO 15 didn’t act alone. It opened the door, but something else had to walk through it. And right on schedule, the fall news cycle delivered exactly what was needed: a public distraction that made the underlying data construction look like a response to chaos rather than what it truly was—a pre-planned systems build.

There’s another layer of damage that never made it into the press releases. What does this architecture do to local control?

In The ALPR Trap, we showed how city councils and police departments were sold camera networks with comforting assurances—short retention limits, “local” use, and no immigration enforcement. The fine print, and the contracts above their heads, told a different story. Once the data left the city and flowed into state and national networks, those local promises became mostly symbolic.

EO 15 repeats that pattern in a more sophisticated key.

This architecture destroys local control. A city council in Davenport or Iowa City can pass all the privacy ordinances it wants, promising residents that police cameras won’t feed federal dragnets. But those promises are now void. By wiring the state DOT and law enforcement networks directly to DHS, Governor Reynolds has effectively preempted every mayor and city council in Iowa.

Their residents’ data is still moving—just through pipes the locals do not control and cannot shut off.

That is the deeper meaning of EO 15. It does not just respond to one hiring failure. It preempts future limits. It ensures that, even if some city council down the road decides to draw a line—to reject Flock contracts, to limit data-sharing, to assert “home rule” over how its residents are monitored—the state has already committed their residents’ IDs and biometric records to a system that transmits them upstream anyway.

This is what “state preemption” looks like in the surveillance era. Not a bill that openly says “cities may not pass X,” but a set of data-sharing obligations and executive orders that make local policy irrelevant by design.

The superintendent scandal provided the noise. The executive order provided the wiring. And Then, in December, the settlement with DHS flipped the system on.

That sequence matters. The order is the tell. Which brings us to the timeline.

The Timing is not a coincidence.

By the time Brenna Bird strode into her December 1st press conference to announce her “federal verification database” deal, the wiring was already in the walls. The public was primed by the Roberts scandal and the E-Verify headlines. Most reporters had never heard of SAVE, much less read EO 15’s technical directives. The idea of a statewide benefits-and-ID clearinghouse had already been normalized in October.

All Bird had to do in December was flip the next switch and keep the name of the system off the microphone.

What happened between September and December wasn’t a coincidence—it was choreography. The public narrative moved one way while the data infrastructure moved another. What looked like disconnected events were, in fact, phases of a single build.

Figure 2 shows that choreography in motion.

Once you see the sequence lined up—the distraction, the build, the activation—the December press conference plays very differently. Bird wasn’t announcing a new tool. She was announcing the final stage of a system that had already been installed.

The most important question becomes:

What exactly did Iowa activate?

That answer requires looking at the part almost no one outside law enforcement understands: the network that moves identity data across state lines without public debate, legislative oversight, or meaningful audit trails.

That network is the heart of the upstream flow into DHS.

• They built the pipe in October.

• They repurposed it in December.

And the only reason it worked is because every step of the build was wrapped in a different story—school safety on the front end, “election integrity” on the back—while the actual machinery was installed in the middle, in language only a handful of lawyers and database administrators were ever expected to read.

That is the quiet brilliance of the design: each stage looked harmless on its own. Only when stitched together does the full system come into view — a prototype for something much larger taking shape beyond Iowa’s borders.

And that raises the question the public never got to ask:

What exactly did Iowa just plug into?

From One Superintendent to Six Million Files

If Executive Order 15 laid the pipe, the next move was figuring out how to turn it on without anyone realizing what they were actually doing.

That required a workaround — because SAVE was never designed, intended, or authorized to verify voters.
Not in its inception in 1986.
Not during the public benefit reforms in IIRIRA in 1996.
And not in any Congressional amendment since.

SAVE was built for one narrow purpose: to check whether immigrants were eligible for public benefits.
It was never a citizenship database.
It was never an elections tool.
Congress never expanded it into one.

Governor Reynolds solved that obstacle by reclassifying your driver’s license as a form of public benefit. And once that reclassification was made, the entire system snapped into place.

The Trick: Using a 1996 Public Benefit Loophole to Unlock a Federal Immigration System

The key statutory language — buried inside 8 U.S.C. § 1621(c)(1) — reads:

“The term State or local public benefit…includes any grant, contract, loan, professional license, or commercial license provided by an agency of a State or local government.”

This clause was never meant to operate as a blanket identity-screening authority. When Congress wrote it, the concern was narrow: preventing a small number of fraudulent applications for specialized licenses.

But Iowa has stretched this language to an absurd extreme.
Under Governor Reynolds’s Executive Order 15, a driver’s license — the most routine credential in everyday life — has been reclassified as a “public benefit” under 8 U.S.C. § 1621. If you hold an Iowa-issued license of any kind — MD, JD, CDL, teaching certificate, cosmetology card — this system already has a hook into you.

This is the trick: change the label, and the entire system follows.

Once a driver’s license is treated as a public benefit, every person renewing their license becomes, in legal terms, a benefits applicant. And SAVE was built to screen benefits applicants.

A person renewing any Iowa license is a benefits applicant. Because Iowa ties voter registration to DMV records, voters are now treated as benefits applicants too.

Every adult Iowan is subject to SAVE screening.

• You did not apply for Medicaid.

• You did not seek food stamps.

• You simply renewed your license.

And under this interpretation, that is enough to run you through a federal immigration-benefits database that was never supposed to contain your information in the first place.

Here’s the Part Few Realize. SAVE was never supposed to contain U.S. citizen data at all. Congress never authorized it. No law expands its scope to voters.

No statute gives DHS authority to load it with:

• Social Security Number records

• Citizenship markers from SSA

• DMV identity data

• Driver’s license photographs

• Facial-recognition-compatible metadata

Yet today, SAVE contains all of that — because these feeds were quietly added through internal DHS-SSA agreements, not public legislation.

This means Iowa has started using a database that was never meant to hold U.S. citizen information but contains millions of U.S. citizen identities anyway. The database will be used to police the voter rolls even though no law was passed to authorize this use. The system Iowa uses to check whether you can vote was never legally authorized to know who you are in the first place.

This is the very definition of a structural overreach — and it didn’t happen by accident. It happened because SAVE was quietly turned into something Congress never intended — a federal identity warehouse.

And that identity warehouse is wired directly into Iowa’s voter system.

The Hidden Cost: Iowa Traded Your Driver’s License Data to DHS

When AG Brenna Bird held her December press conference celebrating a “major victory” for voter verification, the public heard only one side of the deal.

They heard that Iowa gained access to a powerful federal database.
They did not hear what Iowa had to give up to get it.

Because SAVE access is never free. There is always a trade.
And in this case, Iowa traded something that belongs to you:

the entire DMV identity vault.

The Part They Hid: Iowa Agreed to Give DHS Full Access to State Driver’s License Records

The settlement agreement is explicit: Iowa receives SAVE access in turn for granting the Department of Homeland Security full access to state driver’s license records. This is not a gift — it is a data trade.

To run voter checks through SAVE, Iowa must provide DHS with ongoing, continuous access to the state’s driver’s license system. And the DMV does not contain mere “addresses and renewal dates.”

It contains:

• high-resolution driver’s license photographs

• facial-recognition–ready image metadata

• signature images

• vehicle registration

• home address history

• renewal and ID issuance events

• name changes and demographic data

Under the terms of this agreement, all of it becomes accessible to:

DHS, ICE, CBP, FBI, Secret Service, and other federal agencies.

In plain language:

Iowa sold the face of every licensed driver to the federal government.

Not because you broke a law. Not because you applied for a federal benefit. Not because a judge ordered it.

But because Iowa wanted to purge its voter rolls — and this was the price of admission.

How Federal Agencies Get The Data: The Nlets Backdoor

DHS does not connect directly to state DMVs. That would be politically radioactive. Instead, DHS plugs into a powerful nonprofit data broker most Iowans have never heard of:

Nlets — The International Justice & Public Safety Network.

Nlets is a 50-state identity exchange network originally built for law enforcement. This is the same Nlets network we exposed in the ALPR Trap—the law enforcement superhighway where your plate data flows with almost no public oversight. Iowa has opened that same pipe to carry driver's license photos, addresses, and biometric metadata flowing straight to DHS.

But over time, it became a national identity superhighway — a place where DMV records, driver’s license photos, vehicle registration, and identity metadata flow with almost no public oversight and no legislative guardrails.

Most states don’t even realize the full extent of what they’re sending — because Nlets is a legacy system that predates modern privacy law.

And Iowa just opened that pipe all the way. The moment Iowa signed the SAVE agreement, DHS gained continuous access to the state’s full ID vault through a law enforcement network using a voter-purge deal as the legal cover.

This is the “backdoor” in its purest form. Multiple federal agencies including ICE are now able to obtain state driver data without ever having to subpoena the state.

The Exchange: Voter Data Downstream, DMV Data Upstream

If the October order built the pipe and the December settlement turned it on, the Nlets network is the part that reveals what the machine actually does once it begins running. Iowa didn’t simply gain the ability to look into SAVE; it opened its entire DMV identity vault to a multi-agency federal backbone that operates without warrants, subpoenas, or public reporting of any kind.

The movement of information is straightforward. Data leaves the Iowa DOT and enters the Nlets network. From there, it is delivered to DHS, which feeds it into SAVE.

The results then return to Iowa as official verification codes. Driver records move outward. Federal status determinations come back in.

And the public never sees either transaction.

Figure 3 maps the vault and the federal engine it feeds.

What the diagram makes plain is that Iowa’s identity system now runs on a bidirectional rail. Once information enters the federal engine, it is no longer just a background eligibility check; it becomes part of a larger verification architecture that Iowa cannot see and the public cannot audit. And that architecture rests on a distinction most people have never heard of: the difference between Nlets and SAVE — and what each one is built to do.

Nlets vs. SAVE: What Iowa Plugged Into — and Why It Matters

Nlets (State to Federal)
Nlets is the national law-enforcement data backbone that links all 50 state DMVs to federal agencies. Through Nlets, ICE and DHS have long been able to query DMV records — names, addresses, photos, driving histories, and vehicle data. It is a one-way street: states send identity data upward.

SAVE (Federal to State)

SAVE is different. SAVE sends federal identity determinations back downstream to states. When Iowa queries SAVE, DHS returns a status code — citizen, non-citizen, lawful permanent resident, no record, mismatch, or needs further verification.

It becomes a two-way exchange: states ask DHS to define a person’s identity.

Why It Matters

With Nlets alone, federal agencies could look into Iowa’s data.

With SAVE, Iowa is depending on federal data to decide who is eligible for a driver’s license. And because Iowa links driver’s licenses to voter registration, SAVE can influence who is treated as eligible to vote.

Nlets lets DHS see Iowa.

SAVE lets DHS judge Iowa.

Together, they form a closed identity loop: state data flows upstream to DHS, and federal identity codes flow back downstream into state eligibility decisions. This is the system Iowa just activated — and it means every adult Iowan is already subject to a federal benefits-verification database that was never designed to evaluate U.S. citizens or voters.

Iowa gave DHS everything.

DHS gave Iowa verdicts — verdicts that cannot be independently verified, that are generated in a system never authorized to hold U.S. citizen data, and that can be wrong with no legal recourse for the person flagged.

The Attorney General calls this a “victory.”

What the public heard in December was only the downstream half of this loop. The upstream half — the part that opened Iowa’s DMV vault to federal agencies — never made it into the press conference.

The Public Was Told Only One Side of the Contract

In her press conference, Brenna Bird spoke only of what Iowa “gained”: access to a “federal tool” and the ability to “verify voter citizenship.” But she never said that her “settlement” authorizes DHS access to every Iowan’s driver’s license file, that this data is fed into Nlets, or that Nlets already allows ICE to mine state DMV records nationwide.

SAVE was never supposed to hold U.S. citizen data to begin with. This agreement effectively nationalizes Iowa’s identity system. This is not voter integrity. This is identity forfeiture.

And it happened without a debate, without legislation, and without a single Iowan being told what the state traded away in their name.

This agreement doesn’t expire when the headlines fade. Bird's settlement bound Iowa — and every resident — to this data-sharing pipeline for 20 years. Twenty years of driver’s license photos, addresses, renewal histories, and biometric identifiers flowing through Nlets into DHS databases.

Twenty years of federal access to Iowa’s identity system without the legislature voting on it, without public debate, without informed consent. Citizen or not. Resident or not. Immigrants and non-immigrants alike. All of Iowa is in the surveillance grid created by state executive leadership.

At her press conference, Bird beamed as she announced the length of the deal — as if committing an entire state to a 20-year surveillance contract with DHS was an accomplishment.

What This Means for Every Iowan

For the average Iowan, the translation is simple. Your identity was traded away for two decades — and you were never told what Iowa got in return. Iowa did not just plug into SAVE. Iowa plugged SAVE into you.

The most disturbing finding of this investigation is not what Iowa got, but what it gave away. Access to the SAVE database is not a gift. It is a data trade. To “secure” this access, the Department of Homeland Security (DHS) demanded reciprocity. They did not just want to verify names; they wanted to ingest data. This investigation confirms that the mechanism for this trade is the International Justice & Public Safety Network (Nlets).

While participation is ostensibly voluntary, the terms of Iowa’s new settlement force the state to provide DHS with “full use” of its driver’s license records. This was not just a data trade; it was a biometric one. When Iowa agreed to provide DHS with “full access” to its driver’s license system, it handed over more than just addresses and renewal dates.

It handed over high-resolution driver’s license photographs and, critically, the underlying “facial recognition-ready image metadata.” In simple terms, the state of Iowa sold the face of every licensed driver to the federal government. It provided a biometric template of its citizenry to DHS, creating a facial recognition database-in-waiting for federal law enforcement.

This creates a dangerous, bidirectional surveillance pipe: Downstream (The Purge): Iowa pulls “citizenship markers” from SAVE to flag and purge voters. Upstream (The Dragnet): DHS pulls driver’s license photos, home addresses, and biometric data from the Iowa DOT to fuel its own tracking operations.

Together, they form a closed identity loop: state data flows upstream to DHS, and federal identity codes flow back downstream into state eligibility decisions.

Governor Reynolds and AG Bird did not just “sign a deal.” They effectively nationalized the Iowa DMV database. To catch a hypothetical handful of non-citizen voters, they handed the biometric keys to the state’s data vault to federal law enforcement.

If you have a driver’s license in Iowa, your photo, address history, and biometric template sit in a federal system that can decide whether you’re allowed to drive, work, or vote — even though you never applied for a federal benefit and never consented to be in that database.

The Leviathan: Iowa Isn’t an Outlier. It’s a Test Node

What happened in Iowa is not an isolated bureaucratic misfire.

It is not a paperwork mistake or a one-off overreach. It is structural. It is intentional. And it is part of a national blueprint that has been quietly forming for more than a decade. Iowa is simply one of the first states willing to implement the full stack.

What is being built in Iowa is not a simple "election integrity" measure. It is a state-level node of a national surveillance Leviathan. By merging the DMV database (State ID) with SAVE (Federal Status) and connecting them via Nlets (Law Enforcement Sharing), the state has consolidated your identity into a single, searchable track.

This is the "fusion" model in action. It takes data silos that were legally separated for your protection—benefits, driving records, voting rights—and breaks the walls down. Once those walls are gone, the data becomes fluid. A license plate scan from a "financial crime" investigation can be matched to a DMV photo from a "voter check," which can be cross-referenced with a "benefits status" from SAVE.

Iowa officials won’t say the word "SAVE" because they are afraid of what you will find if you Google it. They are afraid you will realize that a tool built to help immigrants has been weaponized into a dragnet that treats every citizen like a suspect.

Brenna Bird called it a victory. Governor Reynolds said it was for the security of our school children. But when the government builds a machine that can watch you from the DMV to the ballot box, using your own face as the tracking beacon, there is only one accurate word for it: Surveillance.

This investigation is not over. The story continues with the federal architecture that enabled this, the corporate contracts that built it, and the full surveillance blueprint Iowa has linked itself to.

The federal contracts, the IBM-scale infrastructure, and the national fusion of benefits, driving, and voting will be the focus of future reporting. But this much is already clear: what Iowa built is not a voter tool. It is a system—and systems, once built, do not unbuild themselves.

In practice, this system routes identity in one direction and power in the other. The state DMV feeds into federal SAVE. State HHS files feed into the Social Security databases SAVE queries. DMV identity records travel through Nlets into DHS pipelines. Federal SAVE status codes flow back down into voter-eligibility decisions in county election offices.

That is not a policy tweak. It is an architecture.

Piece by piece, Iowa has agreed to wire together state records, federal immigration databases, benefits-eligibility files, employment-verification logs, and biometric feeds into a single, query-able profile of every resident. What used to be separate silos—protected by separate laws and norms—now sit behind one verification engine.

Iowa didn’t design this architecture. Iowa simply agreed to flip the switch.

The Pattern: States Like Iowa Are the “Pincer Points.” In our broader investigation, we’ve described The Pincer Movement — a political and technological strategy where the federal and state arms move toward the same surveillance goal from opposite directions.

Iowa is an ideal testbed because power is consolidated and largely unopposed. The governor signs the executive orders, the attorney general commits the state to a 20-year identity-sharing contract, and the legislature has already signed off on pervasive law-enforcement surveillance framed as immigration enforcement.

Even if Iowa officials insist they have no “intent” to misuse this machinery, the question that matters is not what they plan to do with it — but what the system is presently capable of doing.

A database that can automatically delay a newly naturalized citizen’s right to vote simply because SAVE has not updated yet is already a form of structural suppression.

The deeper danger is the data-pipeline architecture itself. With no new legislation—through administrative action alone—the SAVE database was quietly integrated into a state clearinghouse inside Iowa’s newly formed HHS, within the executive branch.

The system can flag a voter, generate a mismatch code, and quietly move that voter into “review” status. Nothing in the current structure prevents a future administration from using that same mechanism to target protesters, political opponents, demographic groups, specific neighborhoods, or entire communities that tend to vote the “wrong” way.

No accusation is needed. The capability exists. There is no independent oversight layer preventing such abuse. When a verification engine becomes powerful enough to invalidate a vote, the only real question is who controls the engine.

This is precisely the environment where a surveillance Leviathan can be built while the public still thinks it's just about “catching fraud.”

The Federal Half: A Quiet Fusion of Databases No One Voted On

While Iowa was building the state-level pipeline, the federal government has been building its mirror system.

SAVE is an immigrant-benefits checker by federal statute. E-Verify was originally an employment tool. SSA Citizenship Files have before this year been separate and protected identity documents. DMV identity data was always held at the state level. Law enforcement networks (Nlets) were originally built for warrants and stolen vehicles.

All of these are being quietly federated into a single, massive federal identity engine that was never authorized by Congress. Iowa’s Executive Order 15 didn’t invent this. It simply harmonized with it.

When you line up Iowa’s actions with the federal contracting documents, the pattern becomes undeniable. State DMVs are the organs. Nlets is the circulatory system. SAVE is the identity warehouse. The voter system is the test case.

And Iowa is the first state to plug in fully — because its leadership cooperated. What It Means for Iowans: You live in a surveillance prototype.

This is no longer hypothetical.

Iowa has a new state agency (HHS) explicitly empowered to run SAVE checks on residents. We have a DMV database wired into federal networks for 20 years by a “settlement” between Brenna Bird and the Trump DOJ. Voter eligibility decisions are being routed through a federal system never built for that purpose.

Iowa ALPR and local surveillance systems are already primed and state leadership openly celebrating the merger of state identity with federal enforcement tools.

Iowa has become a live demonstration of what a fully merged state–federal identity system looks like. Once that system exists, there is no limiting principle. If you can check voters, you can check renters. If you can check renters, you can check employees. If you can check employees, you can check parents, drivers, patients, customers, donors.

Once your identity lives inside a machine built to cross-link everything, the only question left is who gets to query it. This Is the Real Scandal — Not Just What They Did, But What They Made Possible. Nothing in Iowa’s new surveillance architecture is limited to elections. Elections were simply the public justification — the Trojan Horse.

What exists today is a permanent data pipeline between state identity systems and federal agencies using a licensing loophole.

This is enforced through a 20-year contract that no Iowa resident asked for, monitored through unregulated networks and driven by opaque federal status codes with no public oversight and no ability for individuals to contest errors.

This isn’t “election integrity.”

This is governance by database and algorithmic surveillance — a form of identity policing where the machinery is already built — and the people inside it never voted for its creation.

The Stakes: What a System Like This Can Do

To this point, we’ve walked through the mechanics — the executive order, the federal trade, the data flows, the 20-year lock-in. But the real stakes aren’t in the paperwork. They’re in the capability of the system Iowa has wired itself into.

Once a state plugs its identity infrastructure — DMV, voter rolls, HHS records — into a federal verification engine built without legislative oversight, the most important question stops being “What will they do with it today?” and instead becomes, “What could this system be used to do — and who gets to decide?” A system designed for one purpose rarely stays that way.

Start with the most obvious consequence.

Newly naturalized citizens can be disenfranchised instantly and automatically.

SAVE does not update quickly. The “naturalization lag” is a known failure mode. When a resident becomes a citizen, they get a naturalization certificate — but their Social Security record, which SAVE has ingested, often remains outdated for months or even years. The result is a perfectly legal voter flagged as a non-citizen by a database that is technically “correct” about their old status but factually wrong about their right to vote.

Picture a new U.S. citizen in Cedar Rapids who has done everything right: studied for the civics exam, taken the oath, proudly registered to vote. If SAVE still lists their old status, the system quietly tags them as ineligible. Their registration is delayed or challenged. Maybe they are forced onto a provisional ballot. Their first attempt to participate in democracy is denied — not by a poll worker who misread a form, but by a federal code Iowa cannot see, cannot audit, and cannot appeal.

That is not hypothetical. That is how SAVE works today in states already using similar setups. But that’s just the visible edge of the blade.

The deeper danger is structural: Iowa has built a system that can exclude any category of person with a single code.

Once the state funnels eligibility decisions through SAVE status codes, it gains a remarkable power. It can quietly shape who participates in public life — not by accusation, arrest, or criminal penalty, but through “verification.” The voter roll is simply the first place this becomes visible. The verification engine itself doesn’t know it’s looking at voters; it just sees identities. Which leads to the question no one in state government wants to answer: if the system can delay a voter based on a code, what stops a future administration from using it to delay anyone who becomes politically inconvenient?

Nothing in Iowa law stops this. Nothing in federal law stops this. No independent board oversees the system. No audit trail is required. No resident has the right to contest an error inside SAVE or Nlets. No judge signs off before someone is flagged.

So this is not really about what today’s officials say they intend. It is about what the system allows. Once the machinery exists, whoever inherits power inherits the machine.

A system with centralized identity, federal status codes, cross-linked databases, 20 years of state-to-federal data sharing, no public oversight, and automated eligibility decisions is a system that can be repurposed silently. Not in ways that make headlines, but in ways that shave the edges of participation — the quiet tools authoritarian regimes always reach for first.

Could this grid be used to slow down protesters? To quietly frustrate communities that vote the “wrong” way? To label certain neighborhoods as “high-risk” in a future algorithm and make every application from that ZIP code just a little harder? To mark journalists or political dissidents for extra scrutiny, without ever writing their names into a law?

We don’t have to claim that anyone is doing this today. We only have to show that the system is capable of it — and no one is watching it.

Once a system like this is built, once the pipes are laid and the data begins to flow, future officials of any party inherit it as a turnkey tool: already humming, already normalized, already hidden behind bureaucratic language like “verification” and “integrity.”

That is why this matters. That is why Iowa’s case is not just a local story. Iowa has just demonstrated the template. You don’t need to change the law to change who participates in democracy — you only need to change the database.

That’s what this system can do to one person standing alone at a polling place. But the same machinery doesn’t just act on individuals — it can sideline entire communities at once.

Because once the state hard-wires its databases into a federal grid, local promises about privacy and restraint stop mattering. A city can vote to limit surveillance, set retention rules, or keep cameras “local only.” On paper, those protections still exist. In practice, the state has already routed around them.

To see how that works on the ground, you don’t have to imagine a dystopia. You just have to look at what happens the moment an ordinary Iowan walks into the DMV after the state signs a 20-year deal.

What It Feels Like When the Database Decides You Don’t Count

Imagine Mark, a 52-year-old warehouse supervisor in Ankeny. He’s never missed a day of work, never been arrested, never thought twice about politics beyond grumbling about “those damn politicians” over coffee.

One morning he goes to renew his license like he always has. Same office, same line, same laminated form. Only this time, the clerk frowns at the screen.

“I’m sorry, sir. The system can’t verify your status. You’ll need to call this number.”

No one in that office wrote the code that flagged him. No one can see the SAVE record that tripped. No one can tell him whether it was a typo, an old data breach, or a status code that got flipped when Iowa fused its DMV and benefits records into a federal “verification” engine.

All Mark knows is: his renewal is on hold. His CDL is in question. His job is suddenly at risk — not because a judge ruled anything, but because a database Iowa can’t audit whispered that something about him doesn’t match.

Mark just happens to drive a truck. Swap him out for an ER doctor in Iowa City whose hospital can’t get her license renewed on time, a teacher in Cedar Rapids whose background check suddenly “needs review,” or a solo attorney in Council Bluffs whose bar renewal hits the same red code. The job title changes. The machine doesn’t. Once the state treats every license a public benefit, everyone with letters after their name is standing in the same line.

Mark isn’t an immigrant. He isn’t a criminal. He isn’t on any watchlist. He’s just inside the machine now. And once you’re in, every mistake the system makes is your problem to fix — if you’re ever even told it happened in the first place.

Multiply Mark by a thousand quiet errors a year, and you start to see what this really is: not a tool aimed at “them,” but a permanent filter over all of us — one that can be tuned at any moment without a single vote being cast.

And if this is what it can do to one ordinary person trying to renew a license, the next question writes itself.

When the State Pulls Rank on Your City

In last week’s investigation, The ALPR Trap, we showed how local governments and police departments were the key “pressure points” in the surveillance network. City councils could, at least in theory, decide whether their police joined Flock’s network, how long plate data was retained, and whether it was shared upstream with federal partners.

That was true — until the deal Governor Reynolds and Attorney General Bird just signed. By wiring Iowa’s driver’s license system into SAVE and routing that relationship through Nlets, the state has quietly preempted local control over much of this surveillance data. Once the data flows into state-level pipes, it can be queried over Nlets by federal partners, no matter what a city council in Cedar Falls, Des Moines, or Iowa City told its residents.

A city can promise its voters, “We only use these cameras for local crime. We don’t share with ICE.” But when the same state that runs those plates is also feeding its driver’s license records into a repurposed immigrant benefits verification system, and doing it through a law-enforcement network that cities don’t control, those promises are on borrowed time.

In practical terms, that means if the cameras stay up and keep feeding state-reachable systems, the state’s deal with DHS ensures that data will be available to federal agencies, one way or another.

Local leaders can still vote to remove cameras or refuse new contracts — but in Iowa and perhaps other states, once data enters a pipeline governed by the state’s agreements, their authority stops at the city limits.

This is not just about immigration, or voting, or one benefits database. It is part of a broader pattern in Iowa politics: pulling decision-making up from cities and school boards and instead centralizing authoritarian power at the State executive level.

Whether it is DEI, university governance, or now the fate of every driver’s record in the state, the center of gravity keeps moving upward.

With Reynolds’ EO 15 and the SAVE settlement that Brenna Bird announced last week, surveillance followed the same path. The question of “who controls the cameras” is no longer just a local policy debate. It is a question of what the state has promised, and to whom.

Iowa Deserves to Know What Was Built in it's Name

When Governor Reynolds signed Executive Order 15 on October 8th, few Iowans noticed. It was announced in the shadow of a high-profile school scandal, framed as a procedural “E-Verify fix,” and reported as a minor administrative cleanup.

When Attorney General Brenna Bird held her press conference on December 1st, most people walked away believing the state had simply “won access” to a federal tool for election integrity.

No one told them that Iowa had opened a permanent federal pipeline into the state’s identity vault, tied its voter rolls to a benefits database never meant to contain U.S. citizens, locked itself into 20 years of DHS visibility into DMV records and constructed a system whose capabilities far exceed the issue it was sold to address.

No one explained to the public what this architecture actually does. No one explained what it could do. No one explained what it means for the future of democratic participation in this state.

Why this story matters

Iowa did not just acquire a new verification tool. It became a proof-of-concept for a much broader, national identity apparatus — one that merges state DMV data, federal immigration-benefits databases, law enforcement networks, Social Security identity markers, and voter eligibility systems into a single, cross-referenced profile of every resident.

This shift did not go through the legislature, include public debate or require democratic consent. It happened through an executive order, a settlement agreement, and a 20-year contract — stitched together behind a public narrative that never mentioned the true scope of what was being built.

Now the data pipe is running. Not because Iowans asked for it or voted for it—because the state constructed it quietly, assuming no one would read the fine print, trace the pipelines, or understand the federal architecture humming beneath the surface.

But someone did. Thus the question that matters most is not, “Do you trust the current administration?” but instead, “Do you trust every future administration — of either party — with a system this powerful and no oversight?”

Once an identity system is wired into federal databases and state election infrastructure, once it becomes the arbiter of who qualifies and who does not, once it is normalized as the invisible referee of citizenship, employment, benefits, and voting, it never unwires itself.

This is not about fear. It’s about clarity. And clarity is the one thing surveillance systems cannot survive. Iowans—and all Americans—deserve to understand the system built in their name. They deserve transparency. They deserve consent. They deserve democratic control over their own identity infrastructure.

At the very least, they deserve the truth.

A database designed for immigrant benefits has been repurposed into a statewide eligibility engine.

A “voter verification” deal traded away 20 years of driver’s license data. A federal identity warehouse now sits behind Iowa’s elections. Iowa hasn’t just plugged voters into this machine; it has plugged in every licensed profession it can reach—from the DMV counter to the operating room, the classroom, the salon chair, and the courtroom. And no one asked your permission.

As a deliberate policy choice, this is one more step in a long march toward centralized control—away from home rule and toward a surveillance system ordinary Iowans never voted on and were never told about.

The deeper federal architecture behind this deal, and the corporate vendors building it, will be the subject of future reporting. For now, Iowans deserve to know this much: in the span of a few weeks, their governor and attorney general turned a benefits database into a voter-screening tool, turned a “school safety” scandal into a data pipeline, and quietly pulled surveillance power up and away from every city in the state.

But this much is already clear: what Iowa built is not a voter tool. It is a system. And systems, once built, are not easily unbuilt.

The only antidote is sunlight. This is where the sunlight begins.

References

For source documents, legal citations, and the interactive exhibit, see the Evidence Locker for this investigation.

American Immigration Council. (2012). The Systematic Alien Verification for Entitlements (SAVE) program: A fact sheet.

https://www.americanimmigrationcouncil.org

American Immigration Council. (2012). Using SAVE to verify voter eligibility comes with unexplored risks.

https://www.americanimmigrationcouncil.org

Bipartisan Policy Center. (2024). What adding motor vehicle data to USCIS’s SAVE system means for election administration. Bipartisan Policy Center.

Brennan Center for Justice. (2012). Homeland Security’s “SAVE” program exacerbates risks to voters. Brennan Center for Justice.

Fair Elections Center. (2025). Eligible voters at risk: Examining changes to USCIS’s SAVE system. Fair Elections Center.

Iowa Attorney General’s Office. (2025, December 1). Attorney General Brenna Bird secures election integrity win for Iowa [Press release].

Office of the Governor of Iowa. (2025, October 8). Executive Order 15. State of Iowa, Office of the Governor.

National Immigration Law Center. (2020). Nlets: Questions and answers. National Immigration Law Center.

Nlets. (2025). Who we are: Mission and vision. Nlets – The International Justice and Public Safety Network. Nlets

U.S. Citizenship and Immigration Services. (n.d.). Systematic Alien Verification for Entitlements (SAVE) program. U.S. Department of Homeland Security. (Original fact sheet and program description pages.)

U.S. Government Accountability Office. (2017). Verification for benefits: Actions needed to improve evidence for eligibility decisions (GAO-17-204). U.S. Government Accountability Office.

Sunlight is the only antidote to systems built in the dark.

Share

Part II of the Warrantless Surveillance Series By Restoring Democracy's Promise. Part III is here.

The Quietest National System You’ve Never Been Told Exists

You’ve probably driven past one of those cheerful Flock Safety signs posted near a neighborhood park and assumed what everyone else did: a local camera to catch local criminals.

That story is only the front porch of a much larger house. By design, each layer of the Automatic License Plate Reader (ALPR) system hides the layer above it. What looks like a small concession to public safety is actually the entry point to a coast‑to‑coast pipeline that converts your movements into financial intelligence.

Across hundreds of towns and cities, ALPR cameras capture far more than plate numbers. They generate streams of metadata about routes, times and direction. Those streams are fed into state hubs like Texas’s Financial Crimes Intelligence Center (FCIC), where algorithms categorize your movements as a kind of transaction. In this universe, your car becomes an “asset” to be traced, your daily commute morphs into a risk score and your life is reduced to metadata.

What most people—and many local officials—don’t realize is that this architecture doesn’t start or end in your neighborhood. Local plate reads are routed into statewide repositories, fused with financial‑fraud databases and then shared with federal contractors who build behavioral profiles. Because each agency sees only its own slice of the data, the national scope remains invisible. In some places, like Iowa, lawmakers promised a 30‑day retention limit for ALPR data. Yet contracts in Texas mandate a three‑year minimum retention period and require agencies to share their data with “local, state and federal” partners, with no opt‑out.

The result is a single, nationwide financial‑surveillance backbone that most people have never heard of. This investigation will map out how the data moves across state lines, show why the 30‑day promise quietly becomes years, and explain how a law about stopping bitcoin scams was used to legitimize turning your car into a financial asset.

Stay with us: the quietest national system is about to become very loud.

How the Data Actually Moves (Not What Your Police Chief Thinks)

When city councils vote on Flock cameras, they often think the evidence will live in a simple local system. Flock’s sales materials stress “30‑day retention” and reassure that plate data will be hard‑deleted after a month. In reality, the company runs a nationwide data network — more than 20 billion plate readings every month across 49 states and 4,800 agencies. Most police chiefs never see the layers above the Flock dashboard, but those layers determine where your car’s movement data ends up.

This is the part almost no city official, no journalist, and no police chief has ever been shown.

Step 1: Local cameras are Ingestion Points for a National Network

Flock cameras use automatic license‑plate recognition (ALPR) technology to photograph the rear of every vehicle that drives through a neighborhood. Each camera automatically uploads the plate number, vehicle image and location to Flock’s cloud. Flock’s National LPR Network pools those uploads and provides real‑time alerts and retroactive search to more than 4,800 law‑enforcement agencies. Flock advertises that the network connects police departments across states and allows investigators to watch vehicles travel from city to city. In other words, as soon as a plate is captured, it is replicated and distributed across the company’s national infrastructure.

Flock’s standard evidence policy says data is kept for 30 days and then deleted. That is true only within Flock’s own interface — the data is already being copied elsewhere. Flock’s user agreement gives the company a non‑exclusive, non‑transferable, royalty‑free, perpetual license to access and distribute customer data and integration data when an agency requests integration with third‑party investigative platforms. This license allows Flock and the recipient agency to retain vehicle data longer than the 30‑day window. Public records show that roughly 75% of law‑enforcement customers participate in Flock’s National Lookup Tool, which makes plate data visible to thousands of agencies. Once a department opts into this tool, its plate data is visible to roughly 7,000 agencies and organizations. Even if a city tries to opt out of certain sharing, the license terms allow Flock to distribute data for “investigative purposes,” and there is no mechanism for the local agency to delete data from the broader network. “Investigative purposes” is undefined and has included immigration enforcement, reproductive healthcare investigations, political surveillance, protest monitoring and ethnic profiling.

Step 2: Nlets — the National Backbone and Its Built‑In Deniability

After a plate is captured and copied into Flock’s network, the information is registered in the Nationwide License Plate Reader (LPR) Pointer Index, a service operated by the National Law Enforcement Telecommunication System (Nlets). This index doesn’t store the underlying images; it stores metadata such as the event number, time stamp and origin agency. Think of it as a card catalog: when a law‑enforcement agency enters a plate number, Nlets searches its index, then points the requester to the agency that captured the data. Authorized users include U.S. Customs and Border Protection, Homeland Security Investigations, Immigration and Customs Enforcement, the FBI and every state fusion center. Because Nlets only routes the queries, it’s used by counties that lack their own database to look up plates for federal partners, and immigration agencies routinely query it for “pattern‑of‑life” analyses.

This routing‑only design creates plausible deniability at every level. Since Nlets isn’t a storage database, no local police department can see where its data travels. A department in Iowa might upload a scan, and days later agents in Texas can access it, but Iowa has no record of that transaction. Nlets can truthfully say it doesn’t “hold” license‑plate data; it merely relays requests. That structural opacity defeats meaningful public‑records scrutiny: when journalists or FOIA requesters seek to trace a plate’s path, there is no single jurisdiction that can produce the full log. Each actor — the originating agency, Nlets, the receiving agency — can claim ignorance. The result is a national pipeline that makes local scans available to federal agents thousands of miles away while shielding the flow from public view.

Step 3: State Databases and Extended Retention

Once Nlets points to the source agency, the data flows into state‑level license‑plate repositories. Texas is the clearest example. The Texas Department of Public Safety (DPS) requires participating local agencies to send their Flock data to the Texas LPR Database. The DPS memorandum of understanding states that the database stores contributed data for a minimum of three years and that DPS may share the data with any authorized criminal justice agency. Local departments cannot opt out of this sharing once data has entered the system. In other words, even if a city promises a 30‑day retention, Texas DPS will keep the same records for three years and can give them to federal or out‑of‑state partners.

Step 4: Why Texas Turned Into America’s ALPR Laundromat

What makes the Texas layer so significant is a recently adopted legal structure that treats ALPR data as intellectual property of the state. House Bill 3109/Senate Bill 1499, which reorganized the Financial Crimes Intelligence Center (FCIC), stipulates that any information collected under an agreement “becomes the intellectual property of the center” under Gov’t Code §426.053(c), and that when a contract ends the information must be transferred to the department. By reclassifying aggregated collection of vehicle‑movement data as state‑owned IP rather than public records, Texas lawmakers have effectively shielded it from Freedom of Information Act (FOIA) requests and local transparency laws. The statute further authorizes the center to collaborate with federal, state and local agencies, creating a legal framework where data from cities around the country can be pooled in Texas and routed out again without public scrutiny.

Critically, this structure allows the laundering of nationwide plate data through Texas. Because many other states have more restrictive ALPR laws or open‑records statutes, routing the data into a Texas‑based intelligence hub provides a way to circumvent those restrictions. Public‑records requests obtained by the author from multiple Iowa police departments show that Texas hosts the largest number of Flock integration nodes in the national network, suggesting it is a principal hub. These same records reveal that local police chiefs sometimes justify ALPR use by invoking cryptocurrency fraud and other financial scams — arguing that license‑plate readers will help them stop victims on their way to a Bitcoin kiosk. Yet the arrest logs of those departments for the past two years show no cases where an ALPR scan disrupted a Bitcoin‑ATM scam or where prosecutors brought charges tied to local cryptocurrency fraud. This does not mean fraud never occurs; it simply illustrates how rare such incidents are in small Midwestern cities and underscores the mismatch between the “pre‑crime” rationale and the actual record. The fact that chiefs reach for a speculative financial‑crime narrative speaks to the power of the “payment fraud” framing in HB 3109: it recasts human movement as a financial asset, sidesteps Fourth Amendment scrutiny and justifies multi‑year retention. These details come from open‑records responses rather than published reports, but they demonstrate how Texas’ IP law and financial‑crimes framework allow data from across the country to be centralized without public oversight. This design decision helps explain why the national network can operate largely out of view.

The Financial Crimes Intelligence Center (FCIC)

Texas lawmakers codified another layer in 2025. Senate Bill 1499, signed into law, reorganized the Financial Crimes Intelligence Center (FCIC) located in Tyler, Texas under the Texas Department of Licensing and Regulation. The law authorizes the center to collect and analyze data from participating agencies and stipulates that any information collected under an agreement becomes the intellectual property of the center effectively shielding it from public transparency laws; when the agreement ends, the contracting agency must transfer the information to the department. The FCIC may collaborate with federal, state and local agencies. This means plate data supplied by local police becomes property of a state‑run intelligence center, not of the city that collected it, and is insulated from local open‑records laws.

Evidence of this pipeline came to light when the FCIC tipped off Lubbock police about ATM “jackpotting” suspects. Court documents show that an agent with the FCIC told police that a black Honda Civic with Florida plates used in the thefts had been photographed by a license‑plate reader system at a hotel. The lead allowed investigators to track the suspects across multiple jurisdictions. This case demonstrates that FCIC has real‑time access to plate‑reader data and can use it to flag vehicles statewide.

Step 5: Fusion Centers and Private Brokers

After state retention, plate data continues to circulate. Flock’s transparency portals reveal that local departments share data with dozens of agencies across the state. For example, Pflugerville TX PD’s portal notes that “in Texas, license plates are not subject to Open Records Requests” and lists the Texas FCIC among dozens of agencies that receive its data. This shows that not only is there no public transparency, but FCIC is explicitly authorized to ingest data from local Flock cameras.

Fusion centers — multi‑agency intelligence hubs created after 9/11 — further propagate the data. The Wisconsin Examiner reported that the Milwaukee Police Department’s Flock contract ties its cameras to the Southeastern Threat Analysis Center (STAC), a regional fusion center that shares information with the FBI and DHS. Similarly, Flock’s National Lookup Tool enables cross‑state queries by any connected agency. The pointer system and fusion center infrastructure mean there is no local boundary around the data; a query from a patrol car in one state can hit the national Nlets backbone and return results from another in 1.5 seconds.

Step 6: Commercial Data Brokers and Federal Apps

Once plate data is in state and federal systems, it can be reprocessed by private contractors. Thomson Reuters’ CLEAR investigation platform, widely used by ICE and other agencies, integrates license‑plate recognition data from Vigilant Solutions. A Thomson Reuters press release announced that CLEAR users can access Vigilant’s commercial database of more than 6 billion vehicle detections, allowing investigators to identify location histories for a plate and connect addresses and individuals. The Electronic Frontier Foundation notes that Thomson Reuters’ contracts with ICE provide data brokerage services that include license‑plate scans and other personal information. CLEAR and similar products like LexisNexis’ Accurint then feed this information into immigration enforcement and fraud investigations. Flock’s user agreement explicitly permits sharing data with “investigative data platforms”, so once the data is exported, there are no contractual limits on reprocessing or resale.

Other federal tools integrate these feeds. CBP uses mobile apps such as CBP One Vehicle Query to look up vehicle histories. Homeland Security Investigations deploys pattern‑analysis software to monitor travel patterns. Data from Flock, Vigilant, and other ALPR networks feeds into the Palantir Gotham analytics platform and other fusion‑center tools, creating detailed movement profiles for individuals. Palantir markets its platform as providing near‑real‑time tracking of people and vehicles across disparate datasets — a capability that is effectively defined by ALPR feeds. Because these tools rely on commercial data and routing systems like Nlets, they often bypass local privacy ordinances. Researchers have documented how fusion centers circumvent sanctuary‑city restrictions by sharing license‑plate data with ICE.

The Financialization of Movement Data

An emerging thread that ties these systems together is their treatment of human mobility as a financial asset. Texas’ FCIC grew out of statutes aimed at combating payment card fraud, and HB 3109 expands its mission to encompass “payment fraud” in general. By embedding ALPR data into a financial‑crimes framework, officials can argue that tracking vehicles is akin to tracking stolen credit cards or skimmer activity, thereby sidestepping Fourth Amendment protections. This framing also justifies longer retention periods — three years or more — because financial crime investigations often require historical data. Public statements from law enforcement to local reporters (citing, for example, bitcoin theft cases to defend ALPR deployment) reinforce this narrative. Treating location data as a financial commodity opens the door for private data brokers and analytics companies to market these feeds to banks, insurers and fraud‑detection services, further blurring the line between public‑safety surveillance and profit‑driven data mining. Public records obtained by Restoring Democracy’s Promise confirm this shift: financial‑crimes statutes are now being used to legitimize mass vehicle tracking that would otherwise require a warrant.

Why the 30‑day Retention Promise is a Myth

The supposed “30‑day retention” is a political fiction. Flock does remove data from its own interface after 30 days, but the same records are copied into Nlets pointers, state databases, fusion centers and commercial platforms that keep them for years. The Texas DPS MOU requires three‑year retention. Texas HB 3109/SB 1499 designates collected data as intellectual property of the FCIC. Flock’s own transparency portal acknowledges that license‑plate data is not subject to open‑records requests. Private data brokers like Thomson Reuters incorporate ALPR data into vast investigative systems. Once plate data leaves the Flock dashboard, there is no deletion mechanism and no practical way for a city to retract or audit how it is used.

Taken together, these layers reveal a surveillance architecture that is interstate, federal and private‑sector permanent, not a local safety tool. Understanding this data flow is essential for policymakers and residents who want to weigh the privacy and civil‑rights costs of Flock’s “quietest national system” against its purported benefits.

Documented Misuse and The Pincer Movement

As described, public‑records logs and open‑source investigations reveal that this architecture is not just a theoretical risk; it has already been misused.

In August 2025, an audit by the Illinois Secretary of State caught this laundering in action. Despite state laws prohibiting data sharing for immigration or abortion enforcement, the audit revealed that Flock had enabled federal agencies—including ICE and CBP—to access Illinois plate data through “pilot programs.” When exposed, Flock admitted it had “communicated poorly’” and paused the federal pilots, later adding a checkbox requiring out-of-state officers to attest they wouldn’t use the data for prohibited purposes. But as the Texas ‘jackpotting’ case proves, a checkbox is a flimsy barrier against a system designed for friction-less sharing. Once data flows into a fusion center or state intelligence hub, local restrictions evaporate.

Although Flock responded by pausing direct access for federal agencies and adding an Illinois‑specific attestation, the incident demonstrates how data can be laundered through fusion centers and state intelligence hubs, circumventing local restrictions.

Where the System Has Already Been Abused:

• Oak Park, Illinois: 84% of Flock-related stops targeted Black drivers despite comprising only 19% of the population.

• Tulsa PD: Officers searched for “protest” across hundreds of networks without specifying any crimes.

• Multiple agencies: Hundreds of searches using ethnic terms like “roma” and “g*psy” without articulated probable cause.

• San Francisco: At least 19 searches explicitly marked “related to ICE” violating California sanctuary laws.

These misuses and the pejorative search terms for “investigations” mirror the dynamic documented in our wider work, The Pincer Movement: a coordinated assault that combines top‑down pressure from state attorneys general and national groups with bottom‑up narratives that mobilize local officials. The data‑sharing infrastructure acts as the hinge where these forces meet. When local chiefs justify ALPR deployment by citing bitcoin scams, they are helping build the bottom‑up arm; when Texas designates plate data as intellectual property and invites federal agencies to collaborate, it completes the top‑down arm. In the next section we will explore how this pincer dynamic leaves cities trapped between their residents’ privacy concerns and the demands of a powerful surveillance machine.

Join the Investigation

The 30-Day Myth: A Comfortable Lie

“We only keep the data for 30 days.” It’s the line chiefs repeat at council meetings and the reassurance printed in Flock Safety’s Evidence Policy. The company’s standard retention period is indeed thirty calendar days from the date of capture; after that, Flock says, customer data is “hard deleted and will no longer be accessible”. That promise keeps city councils calm and gives residents a sense that privacy is preserved. But it’s a half‑truth.

A Network Built on Replication, not Deletion

What most local officials don’t understand is that the 30‑day deletion applies only to the data visible in Flock’s own interface. The moment a camera snaps a plate, it uploads the scan to Flock’s National LPR Network, which collects over 20 billion plate reads each month across 49 states and 4,800 agencies. Every participating police department becomes a node in this nationwide system. When an officer in Des Moines runs a search, Flock’s software doesn’t just query local cameras; it queries the entire network. In other words, the same plate data is replicated and broadcast across dozens of jurisdictions long before the 30‑day clock runs out.

That replication is by design. Flock’s user agreement grants the company a perpetual, irrevocable license to customer data for “investigative purposes,” allowing the company to provide search access to “law enforcement and public safety agencies” even after the customer deletes its own copy. Roughly 75 % of Flock’s law‑enforcement customers participate in the company’s National Lookup Tool, which makes plate data visible to about 7,000 agencies and organizations. There is no contractual mechanism for a city to retract its data once it’s been shared.

From 30 Days to Three Years and Beyond

Replication is only part of the story. Once a plate is ingested, its metadata is entered into Nlets’ Nationwide LPR Pointer Index, a routing system used by the FBI, CBP and other federal agencies. Nlets does not store the image itself; it stores an event number, timestamp and agency ID, then directs queries back to the origin. This “card‑catalog” system gives any authorized agency the ability to request the underlying record. Because Nlets only routes requests, no single jurisdiction can see where its data goes, and there is no audit trail to FOIA. A plate captured in Iowa can be routed to ICE in Texas without Iowa ever knowing it happened.

After Nlets points to the source, the data flows into state repositories. Here the 30‑day myth fully collapses. Texas is the clearest example: the Department of Public Safety requires local agencies to send their Flock data to the Texas LPR Database, which stores contributed data for a minimum of three years and allows the DPS to share it with any “authorized criminal justice agency”. Local departments cannot opt out once their data enters the system. Other states have similar practices. Even jurisdictions with more restrictive laws, like California’s SB 34, cannot prevent their data from being routed through Nlets to more permissive states.

A System Designed to Reward Participation — And Keep Users in the Dark

At every layer of the ALPR machine, the architecture offers a payoff to those who feed it. For police departments, the immediate reward is convenience. Flock’s automated alerts and national search tool reduce legwork and boost officers’ job satisfaction—departmental audits praise the system for “increasing officer efficiency” and saving time on investigations. But the bigger lure is access. Flock’s own documentation explains that “to use the service, each Flock Safety partner agency must opt in to either the local or national sharing feature”. In other words, a department that wants to search the thousands of Flock cameras in other jurisdictions must agree to share its own scans upstream. Checking that box opens the entire network; declining means seeing only your city’s data. This opt‑in structure quietly encourages departments to hand over local records in exchange for the powerful investigative reach that comes with national visibility. Crucially, once they opt in, their ability to control or retract that data vanishes—Flock’s perpetual license and Nlets’ routing architecture take over. The system rewards participation at the front end while shielding each layer from knowing precisely where the data travels, ensuring that everyone feels they benefit but no one feels responsible.

Intellectual Property and Legal Laundering

What makes the Texas layer especially dangerous is a new legal fiction. In 2025, Texas passed Senate Bill 1499, reorganizing the Financial Crimes Intelligence Center (FCIC). The law stipulates that any information collected under an agreement “becomes the intellectual property of the center” and authorizes the FCIC to collaborate with federal, state and local agencies. By reclassifying vehicle‑movement data as state‑owned intellectual property, lawmakers effectively removed it from public‑records laws. Once a local scan becomes “IP” residents cannot ask for it; city councils cannot audit it; even the capturing agency has no legal claim to it. It is stored for at least three years, and there is no statutory limit on how long it can be retained once “processed.”

This legal camouflage further undermines the 30‑day claim. Texas maintains the largest number of Flock integration nodes in the country, according to public‑records requests obtained by Restoring Democracy's Promise. When a Des Moines officer deletes a scan after 30 days, the identical record may sit in Tyler, Texas for three years or more under the guise of intellectual property.

The Comfortable Lie

So why does the 30‑day myth persist? Because it is politically convenient. Police chiefs can adopt a cutting‑edge surveillance tool while telling city councils that privacy is protected. The 30‑day figure appears in Flock’s marketing materials and is dutifully parroted by local officials. In one Iowa city’s audit, officers documented every search reason and emphasized that no images older than 30 days were retained. Yet the same audit showed the department accessed Flock’s network hundreds of times per month and relied on out‑of‑state alerts for stolen vehicles and warrants. The idea that these records evaporate after a month is comforting—but false.

Understanding the true data flow is essential for anyone weighing the civil‑rights costs of ALPR systems. A plate captured by a local camera does not remain local; it is replicated, indexed, warehoused and reclassified. The legal structures that allow this—perpetual licenses, pointer indexes, IP statutes—were built precisely to keep data from ever being truly deleted. The 30‑day promise is a comfortable lie; the real retention is as long as law enforcement wants it to be.

The hard truth is that the “30‑day deletion” promise is a marketing myth. Every license‑plate scan is replicated across Flock’s national network, indexed by Nlets, warehoused in state repositories like Texas for at least three years, and then treated as state intellectual property. So why are lawmakers and police chiefs so comfortable with a system that quietly builds a permanent record of Americans’ movements?

The answer lies in the legal alchemy performed by the “financial crimes” narrative. By reclassifying location data as a financial asset rather than a privacy‑sensitive surveillance record, states and vendors have created a framework in which perpetual retention and interstate sharing look like consumer protection instead of mass surveillance. The next section unpacks how this framing works and why it’s so effective.

Once lawmakers reclassified your movements as financial intelligence, the entire architecture changed overnight.

How “Financial Crimes” Became the Magic Key

Your movements have been monetized. Not by you — by the system.

Here’s the legal trick that makes it possible:

Step 1: Classify the Data as “Financial.”

Texas’ House Bill 3109/Senate Bill 1499 redefined aggregated ALPR data as the “intellectual property” of the state’s Financial Crimes Intelligence Center (FCIC). By placing vehicle‑movement data under the umbrella of payment‑fraud enforcement, lawmakers effectively removed it from public‑records laws and sidestepped constitutional protections against warrantless location tracking. The FCIC’s statutory mission is to collect and analyze data “from participating agencies” for payment‑card fraud investigations, but in practice the center now warehouses billions of license‑plate scans for three years or longer. When data is reclassified as a financial risk asset rather than personal information, it falls into a regulatory gray zone: financial records have long retention periods and can be shared freely with banks, insurers and law‑enforcement agencies, whereas location data triggers Fourth Amendment concerns.

Iowa took a similar path. As Part 1 of this investigation showed, the state’s crypto‑ATM law mandated blockchain‑analysis surveillance under the guise of consumer protection. Attorney General Brenna Bird’s office sued two crypto‑ATM operators for failing to prevent scams, calling Bitcoin ATMs a hotbed of fraud and warning that only aggressive surveillance could protect Iowans. Around the same time, Bird led multi‑state coalitions urging the U.S. Securities and Exchange Commission to limit federal crypto regulations. These actions weren’t random. Together with 20 other Republican attorneys general, Bird pushed a narrative that “Bitcoin fraud is rampant” and that “financial crimes are everywhere,” creating political cover for states to treat license‑plate data as financial intelligence rather than as location tracking.

Step 2: Build a Messaging Machine

The financial‑crime framing didn’t spread organically. State attorneys general, banking associations and law‑enforcement groups coordinated a messaging campaign. Press releases from Iowa’s AG office stressed that cryptocurrency ATMs were being used to “steal from Iowans”. Legislative hearings in Texas invoked “organized retail crime” and “gift‑card fraud” to justify expanding ALPR powers. National associations warned that surveillance was needed to protect consumers. These messages primed lawmakers and the public to accept extensive data collection as an anti‑fraud measure. As a result, when Texas SB 1499 designated ALPR data as intellectual property and transferred it to the FCIC, there was little public outcry.

Step 3: Reward Participation and Obscure Accountability

The surveillance machine offers rewards at every level. Local police departments are told that ALPR will increase job satisfaction and save investigative time; Flock’s national network provides out‑of‑state alerts for stolen vehicles and warrants, giving small agencies instant access to evidence from around the country.

There’s a catch: to search the nationwide database, agencies must “opt in” to data sharing. Checking that box means uploading all local scans to Flock’s servers and, by extension, to Nlets and state repositories. Departments that decline see only their own data. This incentive structure quietly persuades police to send their residents’ movements upstream in exchange for more investigative power. Meanwhile, the classification of the data as financial intelligence shields the pipeline from FOIA and judicial scrutiny.

Step 4: Close the Loop With Commercial Platforms

Once data is framed as a financial commodity, it flows seamlessly into the private sector. Thomson Reuters’ CLEAR investigation platform integrates license‑plate data from Vigilant Solutions and offers “more than 6 billion vehicle detections” to law enforcement and private investigators. Flock’s user agreement explicitly permits sharing data with “investigative data platforms”. Companies like Palantir and LexisNexis then fuse ALPR records with banking transactions, property records and facial recognition to deliver near‑real‑time “detain” alerts to federal agents. From the state’s perspective, this is still financial intelligence; from the individual’s perspective, it is a dossier of their daily life.

This strategy is morally debatable, but the legal logic is airtight. By classifying movement as an asset, states and corporations bypass constitutional privacy tests and perpetuate a surveillance regime under the banner of consumer protection. The move was coordinated, deliberate and effective.

This is not theory.

The architecture described above is already operating across the United States.

What follows are the public documents, contracts, MOUs, and federal records that confirm how local ALPR scans flow into state reservoirs, commercial platforms, and national law-enforcement networks every single day.

The Evidence — Across Dozens of States

This is no longer a hypothesis. The system’s backbone is clearly documented:

Texas DPS LPR MOU: The memorandum of understanding between local agencies and the Texas Department of Public Safety requires participants to send their ALPR data to the Texas LPR Database, where it is stored for a minimum of three years and shared with any authorized criminal‑justice agency. Local agencies cannot opt out once data enters the system.

Nlets’ Nationwide LPR Pointer Index: The National Law Enforcement Telecommunications System maintains a pointer index that stores the event number, timestamp and origin agency for each scan. Nlets facilitates hundreds of millions of queries every year, including DMV data. A 2025 congressional letter revealed that Nlets processed over 290 million DMV queries, including 292,114 from ICE and 605,116 from Homeland Security Investigations. States can block access, but only a handful do.

SB 1499: Texas’ 2025 law designates ALPR data as state intellectual property, authorizes the FCIC to collaborate with federal, state and local agencies, and requires that all data collected under contract be transferred to the department. This shields the data from public records requests.

San Francisco Data‑Sharing Scandal: Investigative reports revealed that the San Francisco Police Department allowed out‑of‑state agencies—including Georgia and Texas—to run more than 1.6 million searches of its Flock database, with at least 19 searches marked as related to ICE. California law prohibits sharing ALPR data with out‑of‑state law enforcement, yet nearly 4,000 outside agencies accessed SFPD’s system before the city cut them off.

Congressional Alerts: A bipartisan letter led by Senator Ron Wyden and Representative Adriano Espaillat warned governors that Nlets provides “frictionless, self‑service access” to states’ DMV data, allowing ICE and HSI to retrieve personal information without a warrant. The letter urged states to block ICE access and noted that only five states had done so.

Local Installations Everywhere: Flock boasts that its network spans 5,000 communities in 49 states and serves over 4,800 law‑enforcement agencies. Cities from Florida to Washington have installed Flock cameras, often under the impression that they control the data. In reality, once uploaded, the data is routed through Nlets and into state repositories. The architecture is interstate and the consequences are national.

These facts show that the ALPR system is not a patchwork of local experiments; it’s a coordinated, nationwide data‑sharing network. The evidence comes from public records, legislative texts and investigative reporting. When local officials talk about 30‑day retention or isolated crime‑fighting, they ignore the scale and complexity of the pipeline above them. Understanding this evidence is essential to any meaningful debate about privacy, civil rights and surveillance.

These public records, statutes, and investigations show unmistakably that ALPR is not a scattershot collection of local experiments. It is a coordinated, nationwide data-sharing system with unified architecture and shared incentives.

So when local leaders speak of “30-day retention” or “local control,” they are describing only the lowest rung of a multi-layered system they do not oversee.

The system is national.

The data flow is national.

The consequences are national.

Before moving forward, it is important to confront the familiar defenses of this system — the success stories, the “we’re just solving crime,” the assurances of responsible use. These arguments deserve to be heard. But they must be weighed against the documented reality of how the system actually operates, who has access to it, and what cannot be undone once the data leaves local control.

This investigation engages those counterarguments honestly — not to dismiss them, but to evaluate them against the evidence.

Counterarguments: Answered Honestly

Supporters of ALPR systems say they make communities safer.

Police chiefs, sheriffs, some city managers, and even a few neighborhood associations and HOAs point to success stories: a stolen car recovered, a missing child’s vehicle found, a hit-and-run suspect identified in a town like Marshalltown. They argue that if a camera helped solve even one serious crime, it is worth the tradeoff.

Those stories are real.

Nothing in this investigation disputes them.

ALPR can be used in a way that is both effective and compatible with civil rights. A responsible version would look something like this:

• A warrant or documented probable cause for any search that is not purely real-time.

• 48-hour retention, long enough to investigate a fresh crime but too short to build years of travel history on everyone.

• Case-specific queries, tied to an incident number and subject to audit.

• No interstate laundering, where local data silently feeds national indexes.

• No federal backdoor, where ICE, HSI, or other agencies can self-serve DMV and movement data without a judge ever seeing the request.

• No private-vendor permanence, where a for-profit company keeps its own shadow copy in the cloud, outside normal public-records and oversight rules.

Under those rules, Marshalltown Iowa still gets to catch its hit-and-run driver.

You can have that case — and still refuse to run a dragnet on every driver who ever used that road.

But that is not the system we actually built.

What We Have Instead

What we have instead is a financial-intelligence architecture wrapped around everyone’s daily movements. ALPR data is treated the way banks treat suspicious wire transfers: copied, scored, warehoused and cross-referenced with other datasets over years. Once your city opts in, your local scans don’t stay local. They’re replicated into state repositories, pointer indexes like Nlets, and in some cases fusion centers designed to hunt “financial crime” and “transnational threats,” not just stolen Hondas.

Supporters inside city hall and police departments rarely see that full picture. From their vantage point, they asked for a crime-fighting tool, got a vendor demo, saw a couple of success stories and voted yes. The incentives are stacked in their favor:

• Officers get a tool that makes some parts of their job easier and more “data-driven.”

• Chiefs get dashboards and success metrics they can show to councils and local news.

• Cities get to say they are “doing something” about crime without hiring more people.

• Vendors get recurring revenue and, most importantly, access to a river of data.

The public never sees the contract language that quietly authorizes multi-year retention, interstate data-sharing and vendor copies.

They hear about the cameras that caught the drunk driver. They do not hear about how that same pipeline can be queried for protest routes, clinic visits, or the commuting patterns of immigrants and activists— or how easily future officials could repurpose it for those goals.

Given these facts, the question is not whether ALPRs can be used responsibly or whether they sometimes catch bad actors. They can and they do.

The question is what else it does — and who else it serves.

Because once this infrastructure exists, it does not only serve your local detective. It serves state financial-crime units, federal agencies, and any future administration that decides to aim the same machinery at different targets.

Right now, innocent people’s movements are treated like cartel money: aggregated, stored for years, analyzed through financial-crime algorithms and sold to the highest bidder. Politicians say the cameras catch thieves. Meanwhile, federal immigration agents use the same network to track abortion patients and protest organizers. Private vendors make a permanent record of your daily commute and sell it to banks and insurers. State repositories classify your data as intellectual property, shielding it from accountability.

That is not “responsible” policing. It is a mass‑surveillance infrastructure that erodes civil rights and benefits a constellation of actors whose interests have little to do with local crime.

In the next section, we’ll strip away the jargon and follow one ordinary driver through this system — step by step — to show how a perfectly legal day in your life can be quietly turned into a permanent entry in someone else’s risk file.

A Human Moment

What This System Feels Like When It Comes Home

Imagine this.

You’re driving north for a weekend.

It’s one of those ordinary American Fridays: the kids are with their other parent, your phone is on low battery, the weather is fine. You toss an overnight bag in the trunk, grab a coffee from the drive-through, and head out.

You stop at a gas station off the interstate — the one with the faded awning and the two pumps that are always out of receipt paper. There’s a pole at the edge of the lot you’ve never really paid attention to. Today, if you looked closely, you’d see a small box strapped to the top, with a dark glass panel pointed at the road.

You don’t look. You tap your card, fill the tank, and go.

You cross a county line. The scenery doesn’t change much — the same farm fields, the same billboards, the same highway patrol cruiser tucked into the median. You turn off for a smaller town to pick up snacks. There’s a grocery store with a faded “OPEN” sign and a little parking lot. On the way in, you glance up just long enough to catch a glimpse of a camera near the entrance, but you’re thinking about whether you remembered to pay the utility bill.

Nothing special.

Nothing criminal.

Nothing memorable.

You drive north, finish your weekend, and come home. You wash the car at some point. You delete the trip directions from your GPS. Life moves on.

You forget the trip.

A year passes.

The following spring, on a random weeknight, you’re in the kitchen stirring a pot on the stove when you hear a knock at the door. It’s not loud — polite, measured. The kind of knock that expects you to answer.

Two people are on your porch. They’re not in full uniform, but you can see badges on lanyards, clipped to belts. They introduce themselves as investigators. They say it will only take a few minutes.

You’re tired. You’ve had a long day. But you step outside anyway, because that’s what people do when someone with a badge says they have questions.

They start with something vague:

“We’re following up on a pattern we’re required to check.”

You ask what this is about. They don’t answer directly. One of them glances at a tablet in their hand — a government-issue rugged device, screen tilted just enough that you can see colored lines on a map.

They already know:

• which highway you took that weekend

• where you exited

• what time you pulled into the gas station

• how long you were parked near the small grocery store

• which nearby locations have been tagged as “financial risk” nodes.

• They know what direction you turned leaving the lot. They know you crossed back through a certain intersection ten days later at almost the same time of day. They know there were other vehicles on the same route whose plates have also been flagged.

You ask — again, more firmly this time — how they know any of this.

They don’t say “Flock.” They don’t say “Texas.” They don’t say “Nlets” or “Financial Crimes Intelligence Center.” They say:

“Your vehicle was associated with a pattern we’re required to check.”

They use the passive voice. No one “decided” anything; the pattern did. The system did.

You feel your stomach drop anyway. You rack your brain: Did I bounce a payment? Did my card get skimmed? Did I do something wrong? You’re not thinking about the cameras on poles and gas-station lots. You’re thinking about your mortgage, your job, your kids. You’re thinking about what it means to have two strangers on your porch who already know where you were a year ago when you barely remember the trip yourself.

• You never committed a crime.

• You never knew you were scanned.

• You never consented.

But the questions keep coming:

• Have you ever used that gas station ATM?

• Do you know anyone who sends money overseas from that corridor?

• Have you ever given a ride to [they read a name you don’t recognize, or half recognize, or wish you didn’t]?

• What were you doing in that town that weekend?

The subtext isn’t subtle. You are being asked to prove that your normal life, your normal movement, your normal choices are not suspicious. You are presumed relevant to a pattern, and the burden is on you to prove otherwise.

You were not a suspect.

You were a signal.

Somewhere upstream, your plate was pulled into a cluster: a set of times and locations that an algorithm labeled as “elevated risk” under a financial-crime model. That pattern got stored in a database in Texas, where your weekend errand was fused with other people’s movements and scored like a credit card anomaly.

When the pattern tripped a threshold — maybe because someone else on that route did commit a crime, maybe because a corporate risk model updated, maybe because a new law redefined what “risk” means — your car became a lead.

Not because of who you are.

Because of where you happened to be when a camera blinked.

Because under this system, your car is a financial asset, and your movement is a risk profile. And once your data entered Texas, it never came back the same.

This isn’t a science-fiction script. Everything in this scene is within the documented capabilities of the system we’ve just mapped: ALPR cameras at gas stations and store entrances, national pointer indexes, Texas’ financial-crime hub, vendor dashboards that color-code your life into risk scores. The only thing we don’t know is whose door it will be — and what label the system will put on them by the time it knocks.

That’s the point where the personal story loops back into the bigger one.

Because no matter who is standing on the porch, the architecture behind them is the same — and it’s an architecture nobody ever got the chance to vote on.

The Part Nobody Voted For

This is the line nobody crossed at the ballot box:

A nationwide, financial-intelligence tracking system for 330 million people.

Nobody debated that phrase in a statehouse hearing. It never appeared on a city-council agenda. No candidate put it in a campaign ad. There was no up-or-down vote on whether your everyday movement should be scored like a bank transaction and warehoused in another state.

Instead, the system grew in the shadows of ordinary paperwork.

It started with vendor contracts pitched as “local safety tools,” sold with glossy decks and crime-reduction anecdotes. It expanded through federal pointer systems like Nlets, quietly stitching together the data of thousands of separate agencies into a single routing fabric. It deepened as fusion centers — originally marketed as anti-terror hubs — broadened their mandate to anything that could be described as a “threat,” including financial fraud and border enforcement. And it hardened in state legislatures where financial-crime statutes and reorganization bills reclassified your movement as a form of “intellectual property,” placing it under the control of specialized centers that never have to answer your records requests.

Each piece, on its own, looked bureaucratic and technical: a memorandum of understanding here, a “data-sharing enhancement” there, an amendment that tidied up language around “payment fraud.” None of it sounded like a vote on whether your family’s weekend drive should end up in a permanent risk model. But when you line those pieces up end to end, what they form is exactly that: an architecture in which your life is converted into telemetry and then evaluated as a financial risk.

Your car is not a derivative. Your daily commute is not a wire transfer. Yet the system treats them as if they are.

The same logic that flags an unusual card charge in another country is now applied to the pattern of which gas stations you use and which towns you pass through on a Saturday. A machine decides which combinations of time, place and plate number look “interesting,” and that decision can summon a knock at your door a year later.

Today, the labels on the dashboards say things like “fraud,” “organized retail crime,” “transnational threat.” But nothing in the pipeline limits how those labels can change. Once the infrastructure exists — once every small town feeds its scans into financial-intelligence hubs and federal pointer systems — tomorrow’s models can just as easily score trips to a clinic, attendance at a rally, visits to a mosque, patterns common to new immigrants, or routes associated with political dissent.

No one voted for that.

But it’s the logical endpoint of the wiring we have now.

Unless the public intervenes — not in some abstract future, but in the near term, while contracts can still be cancelled and laws can still be rewritten — this grid will lock into place. The longer it runs, the more “normal” it looks, and the more difficult it becomes to roll back or even see clearly.

Because at this point, the core facts are no longer a hypothesis:

• They built it.

• They are using it.

• And unless someone stops it, it will be used on everyone.

A dragnet built in the dark will only ever grow.

Unless we drag it into the light.

What You Can Do Next

This system was not designed to be explained to you. It was designed to run quietly in the background of your daily life. But that doesn’t mean you are powerless.

If you live in a city or county that uses ALPR cameras, you can:

• Ask your council or school board which vendors they contract with and who has access to the data.

• Demand to see the data-sharing agreements: can ICE, fusion centers, or private brokers query your community’s cameras?

• Push for independent audits to identify biased searches, protest surveillance, and misuse of hotlists.

• Urge your representatives to close the “replication loophole” so a 30-day deletion policy actually means the data is gone.

The dragnet only works if nobody asks where the data goes. The moment we start asking, the system has to answer—or be forced to change.

References

• Texas Department of Public Safety, License Plate Reader MOU (primary contract text).

• Electronic Frontier Foundation, License Plate Surveillance Logs Reveal Racist Policing Against Romani People, 2025.

• Electronic Frontier Foundation, How Cops Are Using Flock Safety’s ALPR Network to Surveil Protesters and Activists, 2025.

• ACLU, I’m Hearing About More Pushback Against Flock, Fueled by Concern Over Anti-Immigrant Uses, 2025.

• Yash Dattani, Big Brother is Scanning: The Widespread Implementation of ALPR Technology in America’s Police Forces, Vanderbilt JETLaw, 2022.

• Tucker, T. C., ALPR Leviathan (RDP web exhibit companion).

© 2025 Restoring Democracy’s Promise. All rights reserved. Permission to quote brief excerpts with attribution is granted for news, academic, and advocacy purposes.

Part I of the Warrantless Surveillance Series By Restoring Democracy's Promise. Part II is here.

I. The Widow’s Obituary

Attorney General Brenna Bird is a gifted storyteller.

When she filed lawsuits this year against Bitcoin Depot and CoinFlip — the two largest cryptocurrency ATM operators in Iowa — she described a crime almost operatic in its cruelty: international scammers scanning obituaries, calling newly widowed Iowans, and coercing them into draining their life savings.

She wasn’t alone. Twenty Republican attorneys general across the country launched parallel actions using strikingly similar language, timing, and legal theories — part of the increasingly coordinated enforcement model advanced by the Republican Attorneys General Association (RAGA), whose members frequently act in tight policy alignment.

The story Bird told was powerful. It was emotional. It was politically effective.

And it was incomplete.

Because while the widow is real and the crime is real, the target of Bird’s lawsuit — the crypto ATM machine — is not the source of the crime at all.

II. The Wrong Target

The state’s own filings concede a simple fact: The scammer is never standing at the ATM.

They’re in Cambodia. Or Laos. Or Nigeria. Or a boiler room in Dubai.

The fraud is executed through weeks of social engineering:

• Fake Amazon refund calls

• Romance scams

• “Grandson in jail” emergency scripts

• Pig-butchering tactics targeting older Iowans

The victim — often elderly, often grieving, often isolated — is manipulated into withdrawing money and depositing it into a stationary kiosk at a gas station.

Bird’s lawsuit blames the kiosk. Not the scammer. Not the pipeline that brings the call into the home. Not the law enforcement gaps that allow the syndicates to flourish.

Her stated remedy?

A fee reduction from ~23% to ~15%, and a warning sticker.

Ask any fraud analyst: A sticker does not stop social engineering. It only makes the last mile of the scam cheaper.

Nothing Bird sued for actually disrupts the crime itself.

III. The Hidden Architecture: Surveillance Disguised as Safety

If Bird’s lawsuits don’t stop the scammers, then what do they accomplish?

The answer lives in the structural center of her new crypto law — Senate File 449, Iowa’s new digital financial asset kiosk law, was passed in 2025 during the 91st General Assembly with Bird’s full support and direct policy shepherding. Now codified as Iowa Code § 533C.1004, the law contains a clause buried in its quiet middle that has gone almost entirely unnoticed:

“An operator shall use blockchain analytics software… to detect transaction patterns indicative of fraud or other illicit activities.” — Iowa Code § 533C.1004(7)(c)

In a single sentence, Iowa rewrote consumer protection into a data-extraction regime — one where every “fraud prevention” transaction becomes raw material for permanent behavioral surveillance.

What looks like a safeguard is, in structure and effect, an intake valve — converting the grief of Iowans into analytic fuel for a surveillance architecture that no one voted for and no one can audit.

This is the hidden architecture of the law.

It doesn’t block scam calls. It doesn’t disrupt foreign networks. It doesn’t stop international syndicates.

What it does is create a statewide financial-pattern surveillance system operating through private vendors, outside public view, and outside the constitutional safeguards that normally apply to government monitoring.

To detect “patterns,” the system must first collect them. To collect them, it must log them. To log them, it must retain them. To retain them, it must analyze them. And to analyze them, it must centralize them.

This is the purpose of Bird’s analytics requirement — not to stop crime, but to institutionalize the permanent collection and analysis of Iowans’ financial behavior.

And Bird didn’t design this model alone. The same analytics-first, surveillance-under-consumer-protection strategy is being pushed by 29 other Republican attorneys general as part of a coordinated RAGA-aligned enforcement wave.

Join the Investigation

IV. The Pattern: From Crypto to ALPR to National Surveillance

Bird’s office justifies the law as protecting Iowans from fraud. But the operational design — analytics, pattern detection, external vendors, and cross-jurisdictional sharing — is identical to the statewide expansion of ALPR surveillance through Flock Safety.

The structure is the same:

In each case, the public narrative is protection. The operational reality is infrastructure.

Infrastructure built through private vendors. Infrastructure that bypasses open records. Infrastructure that routes through Texas, where data becomes “intellectual property” exempt from disclosure. Infrastructure that returns to Iowa in forms the public can never FOIA.

This is the model. This is the pattern. And Bird is Iowa’s primary fulcrum for it.

V. The Performance of Protection

We are watching a $20 million performance.

Bird gets headlines. RAGA gets policy victories. Analytics vendors get contracts. Fusion centers get data. Federal agencies get access. Foreign scammers keep scamming.

The only Iowan who loses is the widow Bird used as a political prop.

Her phone still rings. The criminal still calls. The ATM fee is slightly lower. And the only system that actually grew stronger was the surveillance architecture tracking her behavior — not the scammer’s.

VI. References

American Bankers Association. (2025). Iowa targets crypto ATMs for role in alleged scams. ABA Banking Journal. https://bankingjournal.aba.com/2025/03/iowa-targets-crypto-atms-for-role-in-alleged-scams/

Bird, B. (2025, February 27). Attorney General Bird sues crypto ATM companies for costing Iowans more than $20 million [Press release]. Iowa Attorney General’s Office. https://www.iowaattorneygeneral.gov/newsroom/attorney-general-bird-sues-crypto-atm-companies-for-costing-iowans-more-than-20-million/

Bitcoin Depot. (2025). State of Iowa investigatory materials (Redacted Petition). Iowa Attorney General’s Office. https://www.iowaattorneygeneral.gov/media/cms/Final_Bitcoin_Depot_Petition_Redact_4FC03C49F36FD.pdf

Iowa Fraud Fighters. (2025, July 3). Attorney General Bird reminds Iowans of new crypto law now in effect. https://iowafraudfighters.gov/2025/07/03/attorney-general-bird-reminds-iowans-of-new-crypto-law-now-in-effect/

Iowa Legislature. (2025). Senate File 449: Consumer Protection and Cryptocurrency Transactions. https://www.legis.iowa.gov/docs/publications/LGI/91/SF449.pdf

Radio Iowa. (2025, February 27). Iowa Attorney General suing cryptocurrency companies. https://www.radioiowa.com/2025/02/27/iowa-attorney-general-suing-cryptocurrency-companies/

Regulatory Oversight. (2025). State AGs allege Bitcoin ATMs increasingly facilitate scams. https://www.regulatoryoversight.com/2025/03/state-ags-allege-bitcoin-atms-increasingly-facilitate-scams/

San Francisco Standard. (2025). SFPD’s illegal Flock data sharing exposed. https://sfstandard.com/2025/09/08/sfpd-flock-alpr-ice-data-sharing/

NextGov. (2025). States inadvertently share driver data with ICE, lawmakers warn. https://www.nextgov.com/digital-government/2025/11/nearly-20-democratic-states-inadvertently-share-driver-data-ice-lawmakers-say/409469/

Texas Department of Public Safety. (2025). License Plate Reader User Agreement (MOU). https://www.dps.texas.gov/sites/default/files/documents/administration/crime_records/pages/lprmou.pdf

Texas Legislature. (2025). SB 1499 / HB 3109: Financial Crimes Intelligence Center Act. https://fastdemocracy.com/bill-search/tx/89/bills/TXB00075959/